Skip to main content

Case Studies & Evidence

Evidence for consequential decisions

Explore how IG-Smart helps organisations improve governance, privacy, cyber assurance and decision-making in regulated and high-consequence environments.

Explore the Evidence Search Evidence Request Relevant Evidence

  • Named & anonymised evidence

    Real engagements with confidentiality protected

  • Client validation

    Published evidence and testimonials

  • Decision-ready outputs

    Practical, accountable and board-ready

  • Regulated & high-consequence environments

    Experience across complex regulated sectors

Evidence library

Matching case studies

International privacy evidence: AIMIA, Glenmark and a US-headquartered pharmaceutical business.

5 matching case studies · 34 total

  • Addvanced Solutions Community Network logo

    NHS, Health & HealthTech, Named client

    Addvanced Solutions Community Network CIC

    Ongoing vCISO service, penetration testing and security assurance for a community organisation

    Evidence available:

    • Named executive testimonial
    • Engagement scope stated
    • Deliverables described

    What IG-Smart did · Cyber Governance & Assurance

    IG-Smart provides Addvanced Solutions Community Network CIC with an ongoing virtual CISO (vCISO) service under a managed service agreement. Alongside it, IG-Smart has delivered penetration testing across networks, web and mobile applications and wireless infrastructure, mapped findings to the organisation's compliance obligations and provided security awareness training.

    What this demonstrates

    Relevant to health, care and other regulated organisations that need technical security testing connected to wider governance, compliance and workforce-awareness requirements rather than treated as an isolated exercise.

    “IG-Smart's expertise, and dedication to safeguarding our organisation's digital assets are truly commendable.”
    Louise Hankinson, Director, Addvanced Solutions Community Network CIC
    Read the full case study: Addvanced Solutions Community Network CIC
  • Brandon Centre logo

    NHS, Health & HealthTech, Named client

    Brandon Centre

    GDPR and Information Governance improvement programme for Brandon Centre

    Evidence available:

    • Named executive testimonial
    • Engagement scope stated
    • Deliverables described

    What IG-Smart did · Information Governance

    IG-Smart assessed Brandon Centre's GDPR compliance and Information Governance arrangements against relevant NHS good practice, developed a prioritised improvement plan and supported implementation.

    What this demonstrates

    Relevant to organisations seeking a practical route from GDPR and Information Governance assessment to an improvement plan and implementation support.

    “We have found IG Smart to be a professional and supportive firm to work with. I highly recommend them for small and larger organisations.”
    Julia Brown, CEO, Brandon Centre

    Delivery:AssessBuildImprove

    Read the full case study: Brandon Centre
  • Royal Brompton & Harefield NHS Foundation Trust logo

    NHS, Health & HealthTech, Named client

    Royal Brompton & Harefield NHS Foundation Trust

    Three-year managed Information Governance, clinical safety and data-security service for a specialist NHS trust's big-data transformation

    Evidence available:

    • Named executive testimonial
    • Engagement scope stated
    • Deliverables described

    What IG-Smart did · Information Governance

    Over a three-year contract, IG-Smart established Clinical Safety, Cyber Security, Information Governance, Compliance and Risk Management frameworks for Royal Brompton & Harefield NHS Foundation Trust, led the data privacy, security and quality workstreams for its clinical and corporate data warehouse and big-data analytics platform, and managed the Trust's IG, Information Security, Data Quality and IT Training teams. IG-Smart reported directly to the Trust's board-level Senior Information Risk Owner and deputised for the Caldicott Guardian.

    What this demonstrates

    Relevant to NHS trusts, research hospitals and HealthTech suppliers delivering data platforms, analytics or digital clinical systems that need managed IG, clinical safety and DSPT support.

    “They have developed key frameworks that have left our Information Governance processes at the Royal Brompton in a manageable state. IG Smart Ltd proved to be a safe pair of hands to partner with.”
    Graham Everson, Director of IM&T (at the time), Royal Brompton & Harefield NHS Foundation Trust

    Delivery:AssessBuildManageAssure

    Read the full case study: Royal Brompton & Harefield NHS Foundation Trust
  • The Myton Hospices logo

    NHS, Health & HealthTech, Named client

    The Myton Hospices

    NHS Information Governance Toolkit compliance in under two months for a hospice charity

    Evidence available:

    • Named executive testimonial
    • Engagement scope stated
    • Deliverables described

    What IG-Smart did · Information Governance

    IG-Smart worked alongside The Myton Hospices to audit practice, prepare evidence, identify gaps and build an action plan, enabling Myton to achieve NHS Information Governance Toolkit level 2 compliance in under two months. Myton retains IG-Smart annually for ad-hoc advice, support and training, now under the Data Security and Protection Toolkit.

    What this demonstrates

    Relevant to hospices, charities, care providers and other independent organisations that deliver NHS-funded care and must complete the DSPT.

    “IG Smart worked alongside us to audit our practice, prepare our evidence, identify gaps and build an action plan to enable us to become level 2 compliant, which we achieved (with a lot of hard work!) in under two months.”
    David Pratt, Director of Strategy & Business Development, The Myton Hospices

    Delivery:AssessBuildAssureManage

    Read the full case study: The Myton Hospices

  • NHS, Health & HealthTech, Named client

    Off The Record (Twickenham)

    A proportionate Information Governance framework for a young people's charity

    Evidence available:

    • Named executive testimonial
    • Engagement scope stated
    • Deliverables described

    What IG-Smart did · Information Governance

    IG-Smart devised an Information Governance framework for Off The Record designed around the size of the charity and the services it provides to young people. The charity implemented the recommendations and, as reported by its trustee, earned the NHS Digital Toolkit kite-mark.

    What this demonstrates

    Relevant to charities and community organisations that handle sensitive data about the people they support and need NHS Toolkit-ready governance a small team can sustain.

    “Michael and his team devised for Off The Record an Information Governance framework that is wholly appropriate both to the size of our charity, and to the essential services we provide to young people. We have since implemented their recommendations, which have earned us the NHS Digital Toolkit kite-mark, and simultaneously embedded good practice to how our team safely and securely manages the digital and physical data of our beneficiaries”
    Phil Checkland, Trustee, Off The Record

    Delivery:AssessBuild

    Read the full case study: Off The Record (Twickenham)

Client voices

Client voices behind the evidence

IG Smart have provided us with quality subject matter experts surrounding GDPR and Privacy risk-based analysis and remediation; supplying qualified senior information security and experienced DPO and specialists.

Dan WestGlobal CIO, AIMIA ILS

Integrated privacy and information-security expertise

View the evidence — AIMIA ILS case study

What the evidence helps clients decide

Decision-ready outputs

The outlines show how IG-Smart structures typical outputs. They are not client documents.

  • Prioritise remediation

    Independent audit report · Supplier, IG or security audit

    An independent view of how controls operate in practice, with rated findings and recommendations.

    Used by:
    Risk, compliance and procurement leads; supplier owners
    Supports:
    Supplier assurance, remediation and contract decisions
    View typical structure

    Representative IG-Smart structure — client information not shown

    1. 01Scope and method
    2. 02Findings by control area
    3. 03Risk rating and rationale
    4. 04Prioritised recommendations
    5. 05Residual risk and owner

  • Plan and evidence improvement

    Prioritised improvement plan · Readiness for DSPT, ISO/IEC 27001 or audit

    A sequenced plan that turns gaps into owned, evidenced actions.

    Used by:
    Programme owners, SIROs, IG and security leads
    Supports:
    Resourcing, sequencing and readiness decisions
    View typical structure

    Representative IG-Smart structure — client information not shown

    1. 01Current-state gaps
    2. 02Priority and dependency
    3. 03Owner and timescale
    4. 04Evidence required
    5. 05Progress tracking

  • Maintain accountability

    Retained DPO advisory record · Outsourced or fractional DPO service

    A running record of matters raised, advice given and the decisions taken.

    Used by:
    Legal, compliance and data-protection leads
    Supports:
    Accountability, consistent advice and regulator-ready records
    View typical structure

    Representative IG-Smart structure — client information not shown

    1. 01Matter raised
    2. 02Applicable requirement
    3. 03Advice and options
    4. 04Decision owner
    5. 05Follow-up

  • Understand residual risk

    Board assurance summary · Board, committee or executive reporting

    An executive-level view of material findings, residual risk and decisions requiring accountable-owner attention.

    Used by:
    Boards, Audit Committees, accountable executives
    Supports:
    Risk acceptance, remediation prioritisation and assurance decisions
    View typical structure

    Representative IG-Smart structure — client information not shown

    1. 01Assurance question
    2. 02Evidence reviewed
    3. 03Assurance opinion basis
    4. 04Exceptions and risk acceptance
    5. 05Decisions requested

Differentiation

Why organisations appoint IG-Smart

Each reason links to published cases that show it in practice.

  1. Senior practitioner-led

    Engagements are led by experienced practitioners with direct involvement in substantive advisory and assurance work, supported proportionately where appropriate.

    Evidenced by

  2. Independent challenge

    Advice and assurance driven by evidence, requirements and risk rather than incentives to sell a technology platform.

    Evidenced by

  3. Practical, decision-ready outputs

    Work designed to support accountable owners, procurement teams, executives and boards.

    Evidenced by

  4. Experience in regulated and high-consequence environments

    Evidence supported through the published portfolio.

    Evidenced by

  5. Retained capability where continuity matters

    Evidence from managed and long-term client relationships.

    Evidenced by

Confidentiality & controlled disclosure

Evidence without compromising client confidentiality

Some of IG-Smart's most sensitive engagements involve regulatory, operational, security, commercial or patient-safety information that cannot responsibly be published in full. Where necessary, examples are anonymised or withheld from public listing.

Additional evidence may sometimes be available, subject to:

  • Confidentiality
  • Client permissions
  • Appropriateness for the buyer
  • Procurement stage
  • IG-Smart approval

Need evidence relevant to your requirement?

Tell us the sector, service or procurement requirement you are assessing.

Talk to a Senior PractitionerRequest Relevant EvidenceSubmit an RFP or Tender