How MAAS Aviation Built a Robust and Sustainable ISO 27001-Compliant ISMS

MAAS Aviation is a specialist aircraft painting and exterior finishing company operating internationally. With a global footprint of dedicated paint shops in Europe and the US, MAAS is regarded as one of the top aircraft painting companies in the world.

Maintaining resilient services, managing technology risks, supporting business priorities and ensuring systems and processes continue to meet the business’s evolving needs are key objectives for MAAS Aviation’s Head of IT, Isekhua Evborokhai, and his team.

As part of achieving those objectives, the team needed to establish an effective and sustainable ISO/IEC 27001 information security management system (ISMS) that reflected how the business operated and was supported by appropriate evidence.

ISO 27001 implementation would require the business to strengthen organisational oversight, centralise ownership, document controls and produce auditable evidence as the controls become embedded in day-to-day operations.

MAAS Aviation had an established relationship with its trusted MSP partner, Savenet Solutions, who also offer a range of managed IT services, cloud solutions and compliance services. As part of their support, Savenet Solutions provided expert guidance to MAAS Aviation, helping the team build technical information security foundations and documentation.

To formalise the controls and processes for auditability and ISO 27001 compliance, MAAS Aviation leveraged the IO platform. This strategic combination of Savenet Solutions’ technical foundations and the IO platform’s structured compliance management allowed MAAS Aviation a unified compliance journey.

The business also used a bespoke Copilot ISO assistant built by Savenet Solutions. The assistant referenced the ISO 27001 guidance material, queried MAAS Aviation’s processes and helped generate policy documentation for ISO 27001 compliance. These policies were then reviewed and managed within the IO platform.

With the technical foundations supported by Savenet Solutions and using the centralised IO platform, MAAS Aviation streamlined the ISO 27001 compliance process. Savenet Solutions’ cohesive approach across security and compliance provided a strong foundation that fed directly into the IO platform and allowed MAAS Aviation to focus on implementation, evidence management and the certification process.

Alongside using the IO platform to centralise compliance management, MAAS Aviation used IO’s Assured Results Method (ARM) to work strategically through ISO 27001 implementation and compliance, from initial gap analysis to operating, maintaining and improving the ISMS. This structured approach to working through the ISO 27001 clauses and controls gave the team a consistent framework for recording the current state of each control.

MAAS Aviation implemented the majority of ISO 27001 in just two months, after initially expecting the process to take a significantly longer period. MAAS Aviation was able to achieve swift technical alignment with the standard with the support of Savenet Solutions’ managed services, and the bespoke CoPilot ISO Assistant enabled the MAAS Aviation team to accelerate policy writing and implementation.

This joint approach – the structure provided by the IO platform and the ongoing technical support of Savenet Solutions – led to a clear, streamlined implementation process, supporting the hard work of the MAAS Aviation team.

“The IO team has been professional and supportive, providing a structured platform and guidance that helped us navigate the implementation process,” Isekhua says. He adds: “The Savenet Solutions team has been knowledgeable, practical and responsive. They have helped us work through the requirements in a way that considers both certification expectations and the operational reality of MAAS Aviation.”

Achieving certification is an important milestone for MAAS Aviation. However, beyond certification, Isekhua and the team are focused on long-term compliance success, building sustainable information security practices rather than treating compliance as a tick-box exercise.

MAAS Aviation’s next steps will be to continue implementing and embedding the ISMS controls, generate operational evidence and establish the formal internal audit arrangements required by the ISO 27001 programme. The business will then progress management review, any required corrective actions, and a certification-readiness review before undertaking the external certification audit.