01
Identity and access
- Role-based permissions
- Unique user accounts
- Administrative separation
- Session controls
- Access review
- Controlled support access
Security and data protection
Security responsibilities must be visible, testable and shared
Healthcare information requires controls that match the selected architecture, institutional responsibilities and applicable data-protection requirements.
02
Data protection
- Encryption in transit
- Configurable encryption at rest
- Tenant and facility separation
- Retention configuration
- Deletion procedures
- Data residency planning
03
Operational safeguards
- Audit logging
- Backup and recovery planning
- Incident-response procedures
- Vulnerability management
- Deployment monitoring
- Shared responsibility definitions
04
Standards alignment
Zyemed’s security controls and security programme are designed with reference to ISO/IEC 27001 information-security principles. This alignment statement does not represent ISO/IEC 27001 certification. Deployment-specific controls, responsibilities and commitments are defined in the applicable client agreement.