King’s College Hospital NHS Trust, managing several of London’s largest teaching hospitals, engaged i3Secure to help achieve ISO 27001 certification.
The ICT Department had long aspired to attain ISO 27001 certification, an international standard for information security. This goal, alongside their existing well-established technical controls, showed commitment to ensuring a robust, secure digital environment for the Trust.
Operating from one of their London hospitals, the ICT Department manages the comprehensive ICT framework across the Trust. This role is crucial as healthcare management transitions to digital platforms, vastly increasing the scope and importance of their work.
A significant challenge in the public sector is retaining specialist talent, especially in cyber security. Recognising the necessity for ISO 27001 expertise, the Trust sought a proficient partner to help them achieve ISO 27001. With an excellent reputation and extensive experience assisting healthcare organisations, i3Secure was chosen as the Trust’s cyber security partner.
There were two key challenges to overcome for the Trust to achieve ISO 27001 certification. Firstly, maintaining rigorous information security in a large hospital can be challenging, especially when patient care is the priority. Clinicians and other staff focused on delivering the high-quality patient care may not always prioritise adherence to stringent information security protocols if they perceive these as hindering their primary duties.
For such a complex organisation, it was therefore crucial for our Consultant and the ICT team to ensure the scope of the ISO 27001 certification aligned with the Trust’s operational realities. This would give them the best possible chance of successful implementation and compliance.
Secondly, as a public, non-profit body, a primary hurdle was managing the constraints of budget, resources, and skill availability. At the time of our Consultant’s arrival, the Head of Cyber Security role was vacant. This posed a challenge due to the difficulty and expense involved in filling such a specialised role permanently. This vacancy necessitated a temporary redistribution of responsibilities among the existing ICT department members, who were juggling their regular duties with the added demands of overseeing cyber security tasks.
i3Secure offered the Trust industry-leading expertise at comparatively low cost, fitting seamlessly into the organisation to fill the skills gap.
“We found i3Secure responsive and capable in providing the support we needed as the ICT department achieved ISO 27001 certification. The Consultant was professional in delivering the work needed to get us to the right level and was unflinchingly focussed when it came to getting done on time what was necessary.”
Head of ICT Service Management
Working under the management of the Deputy Director of ICT and alongside the Head of ICT Service Management, Our Consultant built an Information Security Management System (ISMS) that would serve the ICT department in their operations and aid assurance of the security of its information.
Given its size and complexity, it was recognised early on that aiming for ISO 27001 certification for the entire Trust might not yield the most efficient or cost-effective results. Therefore, it was strategically decided to first focus certification efforts on the ICT department. The scope would then be extended to include other departments and the wider Trust in future stages. This phased approach ensured controlled, effective implementation.
Our Consultant conducted systematic internal audits throughout the implementation, meticulously covering all aspects of the standard’s requirements. The audit findings were regularly reported back to management, keeping leadership informed on progress and prepared for the steps ahead.
i3Secure enhanced the Trust’s documented governance, addressing gaps that could lead to non-conformances during external audits. Improvements included a new classification scheme tailored to the department’s needs, new procedures for identifying and addressing security events, and new policies for information security and data privacy. These measures were swiftly adopted and significantly improved compliance and audit readiness.
Our Consultant attended all eight days of the audit, meticulously guiding the auditor through the newly implemented ISMS. The audit coincided with launch of new electronic patient record system Epic, meaning ICT staff were exceptionally busy supporting clinicians. The Consultant’s expertise thus minimised effort required from the ICT department, allowing them to focus on supporting frontline staff and prioritising patient health. This was vital in successfully navigating the audit with minimal disruption to healthcare services.
The Trust has achieved the distinguished status of being among the select few hospital trusts certified to ISO 27001. This accomplishment has garnered significant recognition from London’s Integrated Care Board and NHS England. Both have expressed interest in using the Trust as a model for other NHS entities to emulate. They view the Trust’s journey to ISO 27001 certification as an exemplary case study in enhancing information security standards.
i3Secure’s collaboration with the Trust’s ICT Department in developing their new ISMS has been a significant project. The measures taken to achieve ISO 27001 certification have significantly enhanced the organisation’s capability to manage information effectively. This has had a far-reaching impact, as the ISMS now underpins cyber and information security across the entire Trust.
Being a trusted partner to several NHS organisations, i3Secure’s engagement with the Trust has provided assurance in safeguarding patient data. This collaboration highlights i3Secure’s commitment to delivering secure and efficient data management solutions, reinforcing the safety and integrity of patient information across the health sector.
Download the Case Study
“Throughout our engagement with i3Secure on our journey to ISO 27001, they have been professional, helpful and willing to ensure we reached the standard required.
Leading on their behalf was their Consultant, who proved to be invaluable in guiding us through the process. His patience with our NHS processes and delays was appreciated, while his attention to detail meant that we achieved certification with no major findings. His depth of knowledge on ISO 27001 and the certification process ensured we stayed on track throughout the journey.
The Consultant’s gentle humour and infinite flexibility made it a pleasure to work with him. We look forward to continuing to work with i3Secure over the coming years to retain our certification.”
Deputy Director of ICT
Get in touch with our specialists to learn how we can enhance your cyber security posture.
Contact Us 
Contact