SUPPORTED MOBILE BROWSERS
ANDROID AND IOS	Chrome Firefox
ANDROID ONLY	Android v5.0+
IOS ONLY	Safari
WINDOWS 10 MOBILE	Edge
SUPPORTED DESKTOP BROWSERS
WINDOWS AND MAC	Chrome 12+ Firefox 16+ Opera 15+
MAC ONLY	Safari 6+
WINDOWS ONLY	Edge Internet Explorer 10+

Compliance

ISO 27001 Compliance

Last updated: 19h June 2023

The ISO 27000 family of standards helps organizations keep information assets secure.

ISO 27001 is the best-known standard in the family providing requirements for an information security management system (ISMS).

medDigital, the company behind medCrowd, has implemented controls to Annex A of the ISO 27001:2013 standard.

Compliant.

Not compliant. Solution identified and scheduled for implementation.

Not compliant.

Annex	Objective	Control
A.5	Information security policies
A.5.1	Management direction for information security
A.5.1.1	Policies for information security	We have implemented the following policies which, when combined, form our Information Security Management System. Information Security Policy Internal Organisation Policy Mobile Device and Teleworking Policy Human Resource Security Policy Training Policy Information Access Policy Asset Management Policy Information Classification Policy Media Handling Policy Cryptography Policy Physical Security Policy Operations Security Policy Network Security Policy System Acquisition, Development and Maintenance Policy Supplier Relationship Policy Information Security Incident Management Policy Information Continuity Policy Compliance Policy
A.5.1.2	Review of the policies for information security	We review our ISMS annually or when a significant change occurs as per our Information Security Policy
A.6	Organization of information security
A.6.1	Internal organization
A.6.1.1	Information security roles and responsibilities	Addressed by our Internal Organisation Policy
A.6.1.2	Segregation of duties	Addressed by our Internal Organisation Policy
A.6.1.3	Contact with authorities	Addressed by our Internal Organisation Policy
A.6.1.4	Contact with special interest groups	Addressed by our Internal Organisation Policy
A.6.1.5	Information security in project management	Addressed by our Internal Organisation Policy
A.6.2	Mobile devices and teleworking
A.6.2.1	Mobile device policy	Addressed by our Mobile Device & Teleworking Policy
A.6.2.2	Teleworking	Addressed by our Mobile Device & Teleworking Policy
A.7	Human resource security
A.7.1	Prior to employment
A.7.1.1	Screening	Addressed by our Human Resource Security Policy
A.7.1.2	Terms and conditions of employment	Addressed by our Human Resource Security Policy
A.7.2	During employment
A.7.2.1	Management responsibilities	Addressed by our Human Resource Security Policy
A.7.2.2	Information security awareness, education and training	All employees receive information security training when they join and every January thereafter in line with our Training Policy.
A.7.2.3	Disciplinary process	Addressed by our Human Resource Security Policy
A.7.3	Termination and change of employment
A.7.3.1	Termination or change of employment responsibilities	Please see the User Management section of our Information Access Policy
A.8	Asset management
A.8.1	Responsibility for assets
A.8.1.1	Inventory of assets	Addressed by the Asset Management Policy
A.8.1.2	Ownership of assets	Addressed by the Asset Management Policy
A.8.1.3	Acceptable use of assets	Addressed by the Asset Management Policy
A.8.1.4	Return of assets	Addressed by the Asset Management Policy
A.8.2	Information classification
A.8.2.1	Classification of information	Please see our Information Classification Policy
A.8.2.2	Labelling of information	Please see our Information Classification Policy
A.8.2.3	Handling of assets	Please see our Information Classification Policy
A.8.3	Media handling
A.8.3.1	Management of removable media	Addressed by Media Handling Policy
A.8.3.2	Disposal of media	Addressed by Media Handling Policy
A.8.3.3	Physical media transfer	Addressed by Media Handling Policy
A.9	Access control
A.9.1	Business requirements of access control
A.9.1.1	Access control policy	Please see our Information Access Policy
A.9.1.2	Access to networks and network services	Please see the User Management section of our Information Access Policy
A.9.2	User access management
A.9.2.1	User registration and de-registration	Please see the User Management section of our Information Access Policy
A.9.2.2	User access provisioning	Please see the User Management section of our Information Access Policy
A.9.2.3	Management of privileged access rights	Please see the User Management section of our Information Access Policy
A.9.2.4	Management of secret authentication information of users	Please see the User Credentials section of our Information Access Policy
A.9.2.5	Review of user access rights	Please see the User Management section of our Information Access Policy
A.9.2.6	Removal or adjustment of access rights	Please see the User Management section of our Information Access Policy
A.9.3	User responsibilities
A.9.3.1	Use of secret authentication information	Please see the User Credentials & Authentication sections of our Information Access Policy
A.9.4	System and application access control
A.9.4.1	Information access restriction	Please see the User Management section of our Information Access Policy
A.9.4.2	Secure log-on procedures	Please see the User Credentials section of our Information Access Policy
A.9.4.3	Password management system	Please see the User Credentials section of our Information Access Policy
A.9.4.4	Use of privileged utility programs	Please see our Information Access Policy
A.9.4.5	Access control to program source code	Please see our Information Access Policy
A.10	Cryptography
A.10.1	Cryptographic controls
A.10.1.1	Policy on the use of cryptographic controls	Please see our Cryptography Policy
A.10.1.2	Key management	Please see our Cryptography Policy
A.11	Physical and environmental security
A.11.1	Secure areas
A.11.1.1	Physical security perimeter	Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified.
A.11.1.2	Physical entry records	Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified.
A.11.1.3	Securing offices, rooms and facilities	Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified.
A.11.1.4	Protecting against external and environmental threats	Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified.
A.11.1.5	Working in secure areas	Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified.
A.11.1.6	Delivery and loading areas	Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified.
A.11.2	Equipment
A.11.2.1	Equipment siting and protection	Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified.
A.11.2.2	Supporting utilities	Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified.
A.11.2.3	Cabling security	Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified.
A.11.2.4	Equipment maintenance	Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified.
A.11.2.5	Removal of assets	Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified.
A.11.2.6	Security of equipment and assets off-premises	Please see our Physical Security policy.
A.11.2.7	Secure disposal or re-use of equipment	Please see our Physical Security policy.
A.11.2.8	Unattended user equipment	Please see our Physical Security policy.
A.11.2.9	Clear desk and clear screen policy	Please see our Physical Security policy.
A.12	Operations security
A.12.1	Operational procedures and responsibilities
A.12.1.1	Documented operating procedures	Please see our Operations Security policy.
A.12.1.2	Change management	Please see our Operations Security policy.
A.12.1.3	Capacity management	Please see our Operations Security policy.
A.12.1.4	Separation of development, testing and operational environments	Please see our Operations Security policy.
A.12.2	Protection from malware
A.12.2.1	Controls against malware	Please see our Operations Security policy.
A.12.3	Backup
A.12.3.1	Information backup	Please see our Operations Security policy.
A.12.4	Logging and monitoring
A.12.4.1	Event logging	Please see our Operations Security policy.
A.12.4.2	Protection of log information	Please see our Operations Security policy.
A.12.4.3	Administrator and operator logs	Please see our Operations Security policy.
A.12.4.4	Clock synchronisation	Please see our Operations Security policy.
A.12.5	Control of operational software
A.12.5.1	Installation of software on operational systems	Please see our Operations Security policy.
A.12.6	Technical vulnerability management
A.12.6.1	Management of technical vulnerabilities	Please see our Operations Security policy.
A.12.6.2	Restrictions on software installation	Please see our Operations Security policy.
A.12.7	Information system audit considerations
A.12.7.1	Information systems audit controls	All information systems have strong audit controls in-line with our Information Access policy.
A.13	Communications security
A.13.1	Network security management
A.13.1.1	Network controls	Addressed by Network Security Policy
A.13.1.2	Security of network services	Addressed by Network Security Policy
A.13.1.3	Segregation in networks	Addressed by Network Security Policy
A.13.2	Information transfer
A.13.2.1	Information transfer policies and procedures	Please see the Information Handling section of our Information Classification Policy
A.13.2.2	Agreements on information transfer	Please see the Information Handling section of our Information Classification Policy
A.13.2.3	Electronic messaging	Please see the Information Handling section of our Information Classification Policy
A.13.2.4	Confidentiality or non-disclosure agreements	Please see the Information Handling section of our Information Classification Policy
A.14	System acquisition, development and maintenance
A.14.1	Security requirements of information systems
A.14.1.1	Information security requirements analysis and specification	Please see our System Acquisition, Development & Maintenance policy.
A.14.1.2	Securing application services on public networks	Please see our System Acquisition, Development & Maintenance policy.
A.14.1.3	Protecting application services transactions	Please see our System Acquisition, Development & Maintenance policy.
A.14.2	Security in development and support processes
A.14.2.1	Secure development policy	Please see our System Acquisition, Development & Maintenance policy.
A.14.2.2	System change control procedures	Please see our System Acquisition, Development & Maintenance policy.
A.14.2.3	Technical review of applications after operating platform changes	Please see our System Acquisition, Development & Maintenance policy.
A.14.2.4	Restrictions on changes to software packages	Please see our System Acquisition, Development & Maintenance policy.
A.14.2.5	Secure system engineering principles	Please see our System Acquisition, Development & Maintenance policy.
A.14.2.6	Secure development environment	Please see our System Acquisition, Development & Maintenance policy.
A.14.2.7	Outsourced development	We do not outsource development.
A.14.2.8	System security testing	Please see our System Acquisition, Development & Maintenance policy.
A.14.2.9	System acceptance testing	Please see our System Acquisition, Development & Maintenance policy.
A.14.3	Test data
A.14.3.1	Protection of test data	Please see our System Acquisition, Development & Maintenance policy.
A.15	Supplier relationships
A.15.1	Information security in supplier relationships
A.15.1.1	Information security policy for supplier relationships	Addressed by Supplier Relationship Policy
A.15.1.2	Addressing security within supplier agreements	Addressed by Supplier Relationship Policy
A.15.1.3	Information and communication technology supply chain	Addressed by Supplier Relationship Policy
A.15.2	Supplier service delivery management
A.15.2.1	Monitoring and review of supplier services	Supplier Relationship Policy
A.15.2.2	Managing changes to supplier services	Supplier Relationship Policy
A.16	Information security incident management
A.16.1	Management of information security incidents and improvements
A.16.1.1	Responsibilities and procedures	Please see our Information Security Incident Management policy.
A.16.1.2	Reporting information security events	Please see our Information Security Incident Management policy.
A.16.1.3	Reporting information security weaknesses	Please see our Information Security Incident Management policy.
A.16.1.4	Assessment of and decision on information security events	Please see our Information Security Incident Management policy.
A.16.1.5	Response to information security incidents	Please see our Information Security Incident Management policy.
A.16.1.6	Learning from information security incidents	Please see our Information Security Incident Management policy.
A.16.1.7	Collection of evidence	Please see our Information Security Incident Management policy.
A.17	Information security aspects of business continuity management
A.17.1	Information security continuity
A.17.1.1	Planning information security continuity	Please see our Information Continuity policy.
A.17.1.2	Implementing information security continuity	Please see our Information Continuity policy.
A.17.1.3	Verify, review and evaluation information security continuity	Please see our Information Continuity policy.
A.17.2	Redundancies
A.17.2.1	Availability of information processing facilities	Please see our Information Continuity policy.
A.18	Compliance
A.18.1	Compliance with legal and contractual requirements
A.18.1.1	Identification of applicable legislation and contractual requirements	Addressed by our Compliance Policy.
A.18.1.2	Intellectual property rights	Addressed by our Compliance Policy.
A.18.1.3	Protection of records	Addressed by our Compliance Policy.
A.18.1.4	Privacy and protection of personally identificable information	Addressed by our Compliance Policy.
A.18.1.5	Regulation of cryptographic controls	Addressed by our Compliance Policy.
A.18.2	Information security reviews
A.18.2.1	Independent review of information security
A.18.2.2	Compliance with security policies and standards	Addressed by our Compliance Policy.
A.18.2.3	Technical compliance review	Addressed by our Compliance Policy.