Please use the latest version of a supported browser with JavaScript enabled: Got it - don't show me this again
SUPPORTED MOBILE BROWSERS | |
---|---|
ANDROID AND IOS |
|
ANDROID ONLY |
|
IOS ONLY |
|
WINDOWS 10 MOBILE |
|
SUPPORTED DESKTOP BROWSERS | |
WINDOWS AND MAC |
|
MAC ONLY |
|
WINDOWS ONLY |
|
Last updated: 19h June 2023
The ISO 27000 family of standards helps organizations keep information assets secure.
ISO 27001 is the best-known standard in the family providing requirements for an information security management system (ISMS).
medDigital, the company behind medCrowd, has implemented controls to Annex A of the ISO 27001:2013 standard.
Compliant. |
Not compliant. Solution identified and scheduled for implementation. |
Not compliant. |
Annex | Objective | Control |
A.5 | Information security policies | |
A.5.1 | Management direction for information security | |
A.5.1.1 | Policies for information security |
We have implemented the following policies which, when combined, form our
Information Security Management System.
Information
Security Policy |
A.5.1.2 | Review of the policies for information security | We review our ISMS annually or when a significant change occurs as per our Information Security Policy |
A.6 | Organization of information security | |
A.6.1 | Internal organization | |
A.6.1.1 | Information security roles and responsibilities |
Addressed by our Internal
Organisation Policy |
A.6.1.2 | Segregation of duties |
Addressed by our Internal
Organisation Policy |
A.6.1.3 | Contact with authorities |
Addressed by our Internal
Organisation Policy |
A.6.1.4 | Contact with special interest groups |
Addressed by our Internal
Organisation Policy |
A.6.1.5 | Information security in project management |
Addressed by our Internal
Organisation Policy |
A.6.2 | Mobile devices and teleworking | |
A.6.2.1 | Mobile device policy |
Addressed by our Mobile
Device & Teleworking Policy |
A.6.2.2 | Teleworking |
Addressed by our Mobile
Device & Teleworking Policy |
A.7 | Human resource security | |
A.7.1 | Prior to employment | |
A.7.1.1 | Screening |
Addressed by our Human
Resource Security Policy |
A.7.1.2 | Terms and conditions of employment |
Addressed by our Human
Resource Security Policy |
A.7.2 | During employment | |
A.7.2.1 | Management responsibilities |
Addressed by our Human
Resource Security Policy |
A.7.2.2 | Information security awareness, education and training | All employees receive information security training when they join and every January thereafter in line with our Training Policy. |
A.7.2.3 | Disciplinary process |
Addressed by our Human
Resource Security Policy |
A.7.3 | Termination and change of employment | |
A.7.3.1 | Termination or change of employment responsibilities | Please see the User Management section of our Information Access Policy |
A.8 | Asset management | |
A.8.1 | Responsibility for assets | |
A.8.1.1 | Inventory of assets |
Addressed by the Asset
Management Policy |
A.8.1.2 | Ownership of assets |
Addressed by the Asset
Management Policy |
A.8.1.3 | Acceptable use of assets |
Addressed by the Asset
Management Policy |
A.8.1.4 | Return of assets |
Addressed by the Asset
Management Policy |
A.8.2 | Information classification | |
A.8.2.1 | Classification of information | Please see our Information Classification Policy |
A.8.2.2 | Labelling of information | Please see our Information Classification Policy |
A.8.2.3 | Handling of assets | Please see our Information Classification Policy |
A.8.3 | Media handling | |
A.8.3.1 | Management of removable media | Addressed by Media Handling Policy |
A.8.3.2 | Disposal of media | Addressed by Media Handling Policy |
A.8.3.3 | Physical media transfer | Addressed by Media Handling Policy |
A.9 | Access control | |
A.9.1 | Business requirements of access control | |
A.9.1.1 | Access control policy | Please see our Information Access Policy |
A.9.1.2 | Access to networks and network services | Please see the User Management section of our Information Access Policy |
A.9.2 | User access management | |
A.9.2.1 | User registration and de-registration | Please see the User Management section of our Information Access Policy |
A.9.2.2 | User access provisioning | Please see the User Management section of our Information Access Policy |
A.9.2.3 | Management of privileged access rights | Please see the User Management section of our Information Access Policy |
A.9.2.4 | Management of secret authentication information of users | Please see the User Credentials section of our Information Access Policy |
A.9.2.5 | Review of user access rights | Please see the User Management section of our Information Access Policy |
A.9.2.6 | Removal or adjustment of access rights | Please see the User Management section of our Information Access Policy |
A.9.3 | User responsibilities | |
A.9.3.1 | Use of secret authentication information | Please see the User Credentials & Authentication sections of our Information Access Policy |
A.9.4 | System and application access control | |
A.9.4.1 | Information access restriction | Please see the User Management section of our Information Access Policy |
A.9.4.2 | Secure log-on procedures | Please see the User Credentials section of our Information Access Policy |
A.9.4.3 | Password management system | Please see the User Credentials section of our Information Access Policy |
A.9.4.4 | Use of privileged utility programs | Please see our Information Access Policy |
A.9.4.5 | Access control to program source code | Please see our Information Access Policy |
A.10 | Cryptography | |
A.10.1 | Cryptographic controls | |
A.10.1.1 | Policy on the use of cryptographic controls | Please see our Cryptography Policy |
A.10.1.2 | Key management | Please see our Cryptography Policy |
A.11 | Physical and environmental security | |
A.11.1 | Secure areas | |
A.11.1.1 | Physical security perimeter | Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified. |
A.11.1.2 | Physical entry records | Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified. |
A.11.1.3 | Securing offices, rooms and facilities | Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified. |
A.11.1.4 | Protecting against external and environmental threats | Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified. |
A.11.1.5 | Working in secure areas | Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified. |
A.11.1.6 | Delivery and loading areas | Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified. |
A.11.2 | Equipment | |
A.11.2.1 | Equipment siting and protection | Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified. |
A.11.2.2 | Supporting utilities | Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified. |
A.11.2.3 | Cabling security | Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified. |
A.11.2.4 | Equipment maintenance | Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified. |
A.11.2.5 | Removal of assets | Under the shared responsibility model, physical security of the secure area is the responsibility of Amazon Web Services, who are ISO 27001:2013 certified. |
A.11.2.6 | Security of equipment and assets off-premises | Please see our Physical Security policy. |
A.11.2.7 | Secure disposal or re-use of equipment | Please see our Physical Security policy. |
A.11.2.8 | Unattended user equipment | Please see our Physical Security policy. |
A.11.2.9 | Clear desk and clear screen policy | Please see our Physical Security policy. |
A.12 | Operations security | |
A.12.1 | Operational procedures and responsibilities | |
A.12.1.1 | Documented operating procedures | Please see our Operations Security policy. |
A.12.1.2 | Change management | Please see our Operations Security policy. |
A.12.1.3 | Capacity management | Please see our Operations Security policy. |
A.12.1.4 | Separation of development, testing and operational environments | Please see our Operations Security policy. |
A.12.2 | Protection from malware | |
A.12.2.1 | Controls against malware | Please see our Operations Security policy. |
A.12.3 | Backup | |
A.12.3.1 | Information backup | Please see our Operations Security policy. |
A.12.4 | Logging and monitoring | |
A.12.4.1 | Event logging | Please see our Operations Security policy. |
A.12.4.2 | Protection of log information | Please see our Operations Security policy. |
A.12.4.3 | Administrator and operator logs | Please see our Operations Security policy. |
A.12.4.4 | Clock synchronisation | Please see our Operations Security policy. |
A.12.5 | Control of operational software | |
A.12.5.1 | Installation of software on operational systems | Please see our Operations Security policy. |
A.12.6 | Technical vulnerability management | |
A.12.6.1 | Management of technical vulnerabilities | Please see our Operations Security policy. |
A.12.6.2 | Restrictions on software installation | Please see our Operations Security policy. |
A.12.7 | Information system audit considerations | |
A.12.7.1 | Information systems audit controls | All information systems have strong audit controls in-line with our Information Access policy. |
A.13 | Communications security | |
A.13.1 | Network security management | |
A.13.1.1 | Network controls | Addressed by Network Security Policy |
A.13.1.2 | Security of network services | Addressed by Network Security Policy |
A.13.1.3 | Segregation in networks | Addressed by Network Security Policy |
A.13.2 | Information transfer | |
A.13.2.1 | Information transfer policies and procedures | Please see the Information Handling section of our Information Classification Policy |
A.13.2.2 | Agreements on information transfer | Please see the Information Handling section of our Information Classification Policy |
A.13.2.3 | Electronic messaging | Please see the Information Handling section of our Information Classification Policy |
A.13.2.4 | Confidentiality or non-disclosure agreements | Please see the Information Handling section of our Information Classification Policy |
A.14 | System acquisition, development and maintenance | |
A.14.1 | Security requirements of information systems | |
A.14.1.1 | Information security requirements analysis and specification | Please see our System Acquisition, Development & Maintenance policy. |
A.14.1.2 | Securing application services on public networks | Please see our System Acquisition, Development & Maintenance policy. |
A.14.1.3 | Protecting application services transactions | Please see our System Acquisition, Development & Maintenance policy. |
A.14.2 | Security in development and support processes | |
A.14.2.1 | Secure development policy | Please see our System Acquisition, Development & Maintenance policy. |
A.14.2.2 | System change control procedures | Please see our System Acquisition, Development & Maintenance policy. |
A.14.2.3 | Technical review of applications after operating platform changes | Please see our System Acquisition, Development & Maintenance policy. |
A.14.2.4 | Restrictions on changes to software packages | Please see our System Acquisition, Development & Maintenance policy. |
A.14.2.5 | Secure system engineering principles | Please see our System Acquisition, Development & Maintenance policy. |
A.14.2.6 | Secure development environment | Please see our System Acquisition, Development & Maintenance policy. |
A.14.2.7 | Outsourced development | We do not outsource development. |
A.14.2.8 | System security testing | Please see our System Acquisition, Development & Maintenance policy. |
A.14.2.9 | System acceptance testing | Please see our System Acquisition, Development & Maintenance policy. |
A.14.3 | Test data | |
A.14.3.1 | Protection of test data | Please see our System Acquisition, Development & Maintenance policy. |
A.15 | Supplier relationships | |
A.15.1 | Information security in supplier relationships | |
A.15.1.1 | Information security policy for supplier relationships |
Addressed by Supplier
Relationship Policy |
A.15.1.2 | Addressing security within supplier agreements |
Addressed by Supplier
Relationship Policy |
A.15.1.3 | Information and communication technology supply chain |
Addressed by Supplier
Relationship Policy |
A.15.2 | Supplier service delivery management | |
A.15.2.1 | Monitoring and review of supplier services |
Supplier
Relationship Policy |
A.15.2.2 | Managing changes to supplier services |
Supplier
Relationship Policy |
A.16 | Information security incident management | |
A.16.1 | Management of information security incidents and improvements | |
A.16.1.1 | Responsibilities and procedures | Please see our Information Security Incident Management policy. |
A.16.1.2 | Reporting information security events | Please see our Information Security Incident Management policy. |
A.16.1.3 | Reporting information security weaknesses | Please see our Information Security Incident Management policy. |
A.16.1.4 | Assessment of and decision on information security events | Please see our Information Security Incident Management policy. |
A.16.1.5 | Response to information security incidents | Please see our Information Security Incident Management policy. |
A.16.1.6 | Learning from information security incidents | Please see our Information Security Incident Management policy. |
A.16.1.7 | Collection of evidence | Please see our Information Security Incident Management policy. |
A.17 | Information security aspects of business continuity management | |
A.17.1 | Information security continuity | |
A.17.1.1 | Planning information security continuity | Please see our Information Continuity policy. |
A.17.1.2 | Implementing information security continuity | Please see our Information Continuity policy. |
A.17.1.3 | Verify, review and evaluation information security continuity | Please see our Information Continuity policy. |
A.17.2 | Redundancies | |
A.17.2.1 | Availability of information processing facilities | Please see our Information Continuity policy. |
A.18 | Compliance | |
A.18.1 | Compliance with legal and contractual requirements | |
A.18.1.1 | Identification of applicable legislation and contractual requirements | Addressed by our Compliance Policy. |
A.18.1.2 | Intellectual property rights | Addressed by our Compliance Policy. |
A.18.1.3 | Protection of records | Addressed by our Compliance Policy. |
A.18.1.4 | Privacy and protection of personally identificable information | Addressed by our Compliance Policy. |
A.18.1.5 | Regulation of cryptographic controls | Addressed by our Compliance Policy. |
A.18.2 | Information security reviews | |
A.18.2.1 | Independent review of information security | |
A.18.2.2 | Compliance with security policies and standards | Addressed by our Compliance Policy. |
A.18.2.3 | Technical compliance review | Addressed by our Compliance Policy. |