Engineering case study

Induction Healthcare

Cloud controls with evidence behind them.

AWS Cloud SecurityWell ArchitectedCloud Architecture

The challenge

Enterprise procurement required documented security controls, logging and incident response.

The engineering

A workload review followed by centralised logging, encryption, IAM changes and a response runbook.

The result

Documented controls and evidence to support procurement and an independent assessment.

Read the full project story ↓

Client: Induction Healthcare
Industry: Digital Health
Location: London, UK

About project

AWS Cloud Security

Well Architected

Cloud Architecture

AWS

Induction Healthcare builds clinical communication tools for NHS trusts and hospitals across the UK and Australia. Enterprise procurement required demonstrable ISO 27001 alignment and evidence of PHI data controls before contract award.

The situation

Induction Healthcare needed to satisfy security due-diligence requirements from NHS enterprise procurement. The existing AWS environment had grown organically and lacked documented controls, centralised logging or a defined incident response process.

What we built

A Well-Architected Review against the security pillar identified the critical gaps. tMinus1 then implemented: centralised CloudTrail and GuardDuty with alerting to a security mailbox, KMS-managed encryption for all PHI data at rest, IAM roles replacing long-lived access keys, and a documented incident response runbook. A third-party assessor was brought in for final gap analysis.

How we delivered it

Well-Architected Review (week 1), remediation prioritisation and planning (week 2), implementation sprints (weeks 3–7), third-party assessment support (week 8).

The result

ISO 27001-aligned posture documented with evidence. All PHI data flows encrypted end-to-end. Procurement security questionnaire answered with evidence rather than assertions. Contract awarded within two weeks of assessment completion.