Supplier and Cloud Services Policy
| Classification | PUBLIC |
|---|---|
| Owner and approver | Paul Gardner |
| Standard | ISO/IEC 27001:2022, Annex A controls 5.19 to 5.23 |
Purpose
This policy sets out how we choose and manage the suppliers and cloud services that handle our information or support our services, so that our information stays as well protected with them as it is with us.
Scope
This policy applies to every supplier that stores, processes or can reach medDigital information, including cloud services, and to the third-party software our applications are built with.
Choosing a supplier
Before we use a new supplier, we assess how it protects information: its security certifications, where it keeps data, and the terms it offers. A supplier that will hold personal data or support a critical service is approved by the ISMS owner before it is used.
Agreements
Every supplier that handles our information works under a written agreement that covers confidentiality and the security of our information, and requires the supplier to tell us promptly about a security incident that affects us.
Personal data
Suppliers that process personal data for us do so under a written agreement, receive only the data they need to provide their service, and keep it in the UK, the EEA, or a country covered by UK-approved safeguards.
Cloud services
- We understand and record which security responsibilities sit with the cloud provider and which sit with us.
- We choose UK hosting where a service offers it.
- We configure cloud services to the same standards as our own systems.
- For every critical service, we know how we would get our data back and move to another provider.
Third-party software
The third-party packages our applications are built with are audited for known vulnerabilities every day and kept up to date, as described in the Secure Development and Change Policy.
Supplier register
We keep a register of our suppliers: what each one provides, what information it receives, where it holds it, on what basis, and how critical it is to us. The register is kept internally.
Reviews and changes
- Every supplier is reviewed at least once a year: whether we still need it, whether its certifications are current, and whether it has had incidents that affect us.
- When a supplier changes its service in a way that affects our information, we reassess it before we accept the change.
Ending a supplier relationship
When we stop using a supplier, we remove its access and make sure our information is returned or deleted.
How we check
The supplier register is reviewed at the yearly management review. The yearly internal audit checks that each supplier on it has an agreement and a current review.
Exceptions, breaches and review follow the Information Security Policy.
History
| Date | Change |
|---|---|
| 29th October 2026 | Rewritten for ISO/IEC 27001:2022 as Supplier and Cloud Services, replacing the Supplier Relationship Policy, and moved to www.meddigital.com |
| 10th June 2025 | Periodic review |
| 19th June 2023 | Periodic review |
| 24th August 2022 | Suppliers updated |
| 6th June 2022 | Periodic review |
| 16th February 2021 | Periodic review |
| 1st May 2020 | Updated for the introduction of contact centres |
| 12th February 2020 | Periodic review |
| 25th May 2018 | Updated for the Data Protection Act 2018 |
| 15th May 2018 | Supplier added |
| 5th December 2016 | Initial version |