How long does ISO 27001 certification take?

It depends on the starting point. At a unicorn-status crypto business Thomas Kranz built an information security management system from nothing and the company reached ISO 27001 certification in two months. At a blockchain fintech, ISO 27001:2022 certification came within the first three months.

What does a virtual CISO do?

A virtual or fractional CISO provides senior security leadership without the cost of a full-time executive, including security strategy, risk management, board reporting, supplier and regulator management, and leading certifications such as ISO 27001.

Can you help with DORA, MiCA or NIS2?

Yes. Thomas Kranz has built a single roadmap covering MiCA, DORA, NIS2 and MiFID II for a Europe-wide crypto fintech, and delivered MiCA and DORA registration and NIS2-ready incident management for a blockchain fintech.

ISO 27001 in three months and banking licence support for a blockchain fintech

Sector: Financial services and cryptocurrency fintech
Market verticals: Blockchain as a service, regulated crypto exchange, asset tokenisation
Client: A regulated blockchain fintech
My role: Chief Information Security Officer
Period: 2024

The challenge

A cryptocurrency fintech with eight-figure annual revenue was offering blockchain as a service alongside a regulated exchange and asset tokenisation. It needed an enterprise-wide security and risk programme, evidence for banking licence applications in two countries, and compliance with a stack of new European regulation.

What I did

I joined the senior leadership team and designed and implemented a comprehensive IT security and risk management programme. I built NIS2-compliant incident management frameworks and delivered the cybersecurity sections of banking licence applications in two European countries. I established a security and data governance framework that took the company to ISO 27001:2022 certification within the first three months, and worked with legal and compliance leadership to deliver MiCA and DORA registration and compliance.

The result

ISO 27001:2022 certification achieved in the first three months
Cybersecurity evidence delivered for banking licence applications in the Netherlands and France
MiCA and DORA registration and compliance delivered, with NIS2-ready incident management in place

What clients said

“He is calm, methodical and stubborn in exactly the way you want a CISO to be. I watched him operate under pressure… I admire him, trust his judgment… Thomas is firmly in my top five security people to call if something serious happens.”

— Chief Architect and Chief Product Officer, blockchain fintech