Executive Summary

Shivom is a trusted digital consultancy delivering secure, high-performance IT solutions across UK public sector departments. With 20+ years of experience in data engineering, DevOps, enterprise architecture, and digital transformation, Shivom maintains rigorous alignment with ISO/IEC 27001 and Cyber Essentials standards. All personnel are BPSS-cleared, supporting access to sensitive systems. A security-first approach is embedded across operations, backed by robust annual training, tested business continuity plans, and supplier diligence. Shivom’s integrated governance framework reinforces cybersecurity and resilience in every service, providing assurance to clients requiring agility, compliance, and dependable delivery.

The Challenge

Operating in high-assurance Client’s environments, Shivom faced the critical challenge of ensuring all staff — including new starters, contractors, and temps — were trained and competent in information security, data protection, and cyber threat response. This was vital to maintain compliance with ISO/IEC 27001 and GDPR.

Objectives

🎯 Ensure 100% compliance with information security and data protection policies
🔐 Embed a security-aware culture across the organisation
⚠️ Mitigate human risks like phishing, data loss, and remote work vulnerabilities
📜 Align to ISO/IEC 27001:2022 and GDPR frameworks

Approach & Implementation

📘 Policy-Driven Framework
Developed and maintained an ISMS aligned with ISO/IEC 27001:2022, with formalised policies on security, data protection, training, and enforcement.
🎓 Induction and Onboarding
All new staff receive security briefings and policy induction within 10 working days, including signing confidentiality agreements and reading key policies.
📊 Competency and Training Plans
Implemented a role-based competency matrix and annual training plan including internal/external courses on cyber awareness, data handling, and business continuity. Evaluation records are centrally maintained.
🔄 Ongoing Awareness and Assessments: Delivered annual refresher training (last held July 2025 via MS Teams) covering:
🧠 GDPR principles
🗃️ Data classification, retention, and disposal
🔑 Cyber hygiene: phishing, MFA, secure file sharing
🚨 Incident response/reporting protocols
Interactive quizzes and scenario exercises ensured engagement and understanding.
⚖️ Disciplinary Enforcement
Clear disciplinary procedures reinforce the importance of compliance and enable consistent incident handling.
📦 Business Continuity Alignment
Training includes modules on emergency and cyber incident response to ensure operational continuity.

Outcomes

✅ 100% staff completion of July 2025 refresher

⏱️ Faster incident reporting and improved response protocols

📋 Positive internal and external audit outcomes on ISMS effectiveness

🤝 Increased client trust, especially in high-compliance environments

Lessons Learned

🔍 Introduced follow-up assessments based on quiz performance

📅 Annual review of training materials ensures alignment with evolving threats and regulatory updates

Conclusion

Through structured policies, immersive training, and continual improvement, Shivom has built a resilient, security-conscious workforce. This has become foundational in supporting public sector clients operating in high-assurance environments, ensuring compliance with ISO 27001 and GDPR while mitigating operational and reputational risks.