ISO/IEC 27001:2022 — done with you, not to you.
A clear, guided path from wherever you are today to a certified information security management system — led by an accredited Lead Auditor who also knows how attackers think.
Five stages, no surprises.
Most organisations reach certification in around 6–12 months, depending on starting maturity. We'll give you a realistic timeline after the gap assessment.
We measure your current state against all 93 Annex A controls and the management-system clauses, then hand you a prioritised report of exactly what's missing and what's already fine.
We help you close the gaps and stand up the policies, risk assessment, Statement of Applicability and evidence your ISMS needs — practical and right-sized, not a binder no one reads.
A full internal audit of your ISMS to find and fix non-conformities before the certification body ever sees them — exactly the rehearsal you want.
We prepare you for, and support you through, the certification body's Stage 1 (documentation) and Stage 2 (implementation) audits — and help you respond to any findings.
Certification lasts three years with annual surveillance audits. We keep your ISMS healthy between them — and Maul keeps your controls continuously evidenced.
A map, not a maze.
Auditor's eye, attacker's mind.
Most consultancies can write you a policy. We also test whether it actually holds up — because we red-team for a living. Your controls don't just exist on paper; we've tried to break them. That's an ISMS auditors trust and attackers respect.
Common questions
Typically 6–12 months end to end, driven by your starting maturity and how quickly remediation gets done. The gap assessment gives you a firm timeline.
No — and nobody reputable does both. An independent certification body issues the certificate; we prepare you to pass their audit with confidence.
No. The standard scales. We right-size the ISMS to your business so it's genuinely useful, not bureaucracy for its own sake.
Yes. If you already have policies or a part-built ISMS, the gap assessment simply picks up from where you are.