Security

Statement of Applicability

This lists every control in Annex A of ISO/IEC 27001:2022, whether it applies to medDigital, and the policy that covers it. Where a control does not apply, the reason is given.

5 Organisational controls

ControlAppliesCovered by
5.1 Policies for information security Yes Information Security Policy
5.2 Information security roles and responsibilities Yes Organisation, Roles and Risk Policy
5.3 Segregation of duties Yes Organisation, Roles and Risk Policy
5.4 Management responsibilities Yes People Security Policy
5.5 Contact with authorities Yes Organisation, Roles and Risk Policy
5.6 Contact with special interest groups Yes Organisation, Roles and Risk Policy
5.7 Threat intelligence Yes Operations Security Policy
5.8 Information security in project management Yes Organisation, Roles and Risk Policy
5.9 Inventory of information and other associated assets Yes Asset Management and Information Handling Policy
5.10 Acceptable use of information and other associated assets Yes Acceptable Use Policy
5.11 Return of assets Yes Asset Management and Information Handling Policy
5.12 Classification of information Yes Asset Management and Information Handling Policy
5.13 Labelling of information Yes Asset Management and Information Handling Policy
5.14 Information transfer Yes Asset Management and Information Handling Policy
5.15 Access control Yes Access Control and Identity Policy
5.16 Identity management Yes Access Control and Identity Policy
5.17 Authentication information Yes Access Control and Identity Policy
5.18 Access rights Yes Access Control and Identity Policy
5.19 Information security in supplier relationships Yes Supplier and Cloud Services Policy
5.20 Addressing information security within supplier agreements Yes Supplier and Cloud Services Policy
5.21 Managing information security in the ICT supply chain Yes Supplier and Cloud Services Policy
5.22 Monitoring, review and change management of supplier services Yes Supplier and Cloud Services Policy
5.23 Information security for use of cloud services Yes Supplier and Cloud Services Policy
5.24 Information security incident management planning and preparation Yes Incident Management Policy
5.25 Assessment and decision on information security events Yes Incident Management Policy
5.26 Response to information security incidents Yes Incident Management Policy
5.27 Learning from information security incidents Yes Incident Management Policy
5.28 Collection of evidence Yes Incident Management Policy
5.29 Information security during disruption Yes Business Continuity Policy
5.30 ICT readiness for business continuity Yes Business Continuity Policy
5.31 Legal, statutory, regulatory and contractual requirements Yes Compliance, Legal and Privacy Policy
5.32 Intellectual property rights Yes Compliance, Legal and Privacy Policy
5.33 Protection of records Yes Compliance, Legal and Privacy Policy
5.34 Privacy and protection of PII Yes Compliance, Legal and Privacy Policy
5.35 Independent review of information security Yes Compliance, Legal and Privacy Policy
5.36 Compliance with policies, rules and standards for information security Yes Compliance, Legal and Privacy Policy
5.37 Documented operating procedures Yes Compliance, Legal and Privacy Policy

6 People controls

ControlAppliesCovered by
6.1 Screening Yes People Security Policy
6.2 Terms and conditions of employment Yes People Security Policy
6.3 Information security awareness, education and training Yes People Security Policy
6.4 Disciplinary process Yes People Security Policy
6.5 Responsibilities after termination or change of employment Yes People Security Policy
6.6 Confidentiality or non-disclosure agreements Yes People Security Policy
6.7 Remote working Yes People Security Policy
6.8 Information security event reporting Yes Incident Management Policy

7 Physical controls

ControlAppliesCovered by
7.1 Physical security perimeters Yes Physical Security Policy
7.2 Physical entry Yes Physical Security Policy
7.3 Securing offices, rooms and facilities Yes Physical Security Policy
7.4 Physical security monitoring Yes Physical Security Policy
7.5 Protecting against physical and environmental threats Yes Physical Security Policy
7.6 Working in secure areas Yes Physical Security Policy
7.7 Clear desk and clear screen Yes Acceptable Use Policy
7.8 Equipment siting and protection Yes Physical Security Policy
7.9 Security of assets off-premises Yes Physical Security Policy
7.10 Storage media Yes Asset Management and Information Handling Policy
7.11 Supporting utilities Yes Physical Security Policy
7.12 Cabling security Yes Physical Security Policy
7.13 Equipment maintenance Yes Physical Security Policy
7.14 Secure disposal or re-use of equipment Yes Physical Security Policy

8 Technological controls

ControlAppliesCovered by
8.1 User endpoint devices Yes Endpoint and Mobile Devices Policy
8.2 Privileged access rights Yes Access Control and Identity Policy
8.3 Information access restriction Yes Access Control and Identity Policy
8.4 Access to source code Yes Secure Development and Change Policy
8.5 Secure authentication Yes Access Control and Identity Policy
8.6 Capacity management Yes Operations Security Policy
8.7 Protection against malware Yes Endpoint and Mobile Devices Policy
8.8 Management of technical vulnerabilities Yes Operations Security Policy
8.9 Configuration management Yes Operations Security Policy
8.10 Information deletion Yes Asset Management and Information Handling Policy
8.11 Data masking No Production data is not used for testing, apart from one controlled exception set out in the Secure Development and Change Policy, so data masking is not needed.
8.12 Data leakage prevention Yes Acceptable Use Policy
8.13 Information backup Yes Backup Policy
8.14 Redundancy of information processing facilities Yes Business Continuity Policy
8.15 Logging Yes Operations Security Policy
8.16 Monitoring activities Yes Operations Security Policy
8.17 Clock synchronization Yes Operations Security Policy
8.18 Use of privileged utility programs Yes Access Control and Identity Policy
8.19 Installation of software on operational systems Yes Operations Security Policy
8.20 Networks security Yes Operations Security Policy
8.21 Security of network services Yes Operations Security Policy
8.22 Segregation of networks Yes Operations Security Policy
8.23 Web filtering Yes Endpoint and Mobile Devices Policy
8.24 Use of cryptography Yes Cryptography Policy
8.25 Secure development life cycle Yes Secure Development and Change Policy
8.26 Application security requirements Yes Secure Development and Change Policy
8.27 Secure system architecture and engineering principles Yes Secure Development and Change Policy
8.28 Secure coding Yes Secure Development and Change Policy
8.29 Security testing in development and acceptance Yes Secure Development and Change Policy
8.30 Outsourced development No We do not outsource development.
8.31 Separation of development, test and production environments Yes Secure Development and Change Policy
8.32 Change management Yes Secure Development and Change Policy
8.33 Test information Yes Secure Development and Change Policy
8.34 Protection of information systems during audit testing Yes Operations Security Policy