King’s College Hospital NHS Trust (KCH) ICT and CogStack have successfully completed an independent external audit confirming ISO/IEC 27001:2022 compliance for the information security management controls supporting the deployed CogStack Health Data Environment to a TRE/SDE-level of security and governance.
This provides third-party assurance that the way these organisations manage information security across this Secure Data Environment (SDE) is structured, robust, and continually improving.
Each data environment is required to meet security and data privacy standards. CogStack supports SDEs with the expertise and toolkit to meet accreditation requirements, ensuring that a fully deployed SDE which interfaces with third parties has the right security measures in place, in-line with TRE regulation, meets ISO 27001:2022.
ISO/IEC 27001 is the internationally recognised standard for information security management. Compliance confirms that an organisation has a formal Information Security Management System (ISMS) in place—covering governance, risk management, policies and controls, incident management, and ongoing monitoring and improvement. In practice, it means information security isn’t treated as an add-on or a one-off exercise; it is embedded into day-to-day operations and decision-making.
“Achieving independent confirmation of ISO/IEC 27001:2022 compliance for the KCH TRE is an essential component of what CogStack delivers. Our capacity and expertise in security and data compliance is a core aspect of how we work with the partners who trust us with some of the most sensitive data in healthcare,” said Tom Searle, CEO of CogStack. “As we expand our work across the UK and internationally—supporting providers to improve clinical operations and accelerating clinical research—this certification provides clear assurance that we can deliver in every deployment security governance, risk management and operational controls that meet globally recognised standards. It helps our healthcare provider partners adopt and scale CogStack with confidence, reducing assurance friction and reinforcing a shared commitment to safe, responsible innovation.”
For organisations considering CogStack—particularly those working in complex, regulated environments such as healthcare and life sciences—ISO 27001:2022 compliance brings several practical benefits. It provides increased confidence that information is handled responsibly and consistently, with clear accountability and oversight. It demonstrates that risks are identified, assessed, and managed in a repeatable way, rather than relying on ad hoc controls. It also supports smoother procurement and assurance processes, as many organisations look for recognised standards when assessing suppliers and partners.
Just as importantly, this is not a “badge” that is achieved and then filed away. ISO 27001 demands continuous improvement, helping ensure that our security controls evolve as threats, technologies, and customer needs change. It reinforces the quality and governance processes that underpin how CogStack is built, deployed, and supported—so customers can focus on using the platform to deliver value, with confidence in the foundations.
We are proud to share this achievement and we see it as part of our broader commitment to trust, transparency and operational excellence. If you’d like to understand what this means for your organisation or discuss your assurance requirements, we’d be happy to talk.
