How long does ISO 27001 certification take?

It depends on the starting point. At a unicorn-status crypto business Thomas Kranz built an information security management system from nothing and the company reached ISO 27001 certification in two months. At a blockchain fintech, ISO 27001:2022 certification came within the first three months.

What does a virtual CISO do?

A virtual or fractional CISO provides senior security leadership without the cost of a full-time executive, including security strategy, risk management, board reporting, supplier and regulator management, and leading certifications such as ISO 27001.

Can you help with DORA, MiCA or NIS2?

Yes. Thomas Kranz has built a single roadmap covering MiCA, DORA, NIS2 and MiFID II for a Europe-wide crypto fintech, and delivered MiCA and DORA registration and NIS2-ready incident management for a blockchain fintech.

A regulator-ready security function for a Europe-wide crypto fintech

Sector: Financial services and cryptocurrency fintech
Market verticals: Regulated fintech, digital assets, payments
Client: A regulated crypto fintech operating across Europe
My role: Chief Information Security Officer
Period: 2026

The challenge

A fast-growing, regulated cryptocurrency fintech with nine-figure annual revenue was answering to several regulators across Europe at once. It needed to meet MiCA, DORA, NIS2 and MiFID II requirements, and it needed a security function that could stand up to regulatory scrutiny.

What I did

I joined the senior leadership team as CISO and built a strategic two-year roadmap to ISO 27001 certification, designed to support every one of those regulatory requirements in a single programme, so the work was done once and not repeated for each regulator. I established an operational security function, working directly with the Chief Risk Officer and Chief Compliance Officer to manage regulatory and licensing issues as they arose. I also led cybersecurity and data governance compliance end to end, and contributed to the company's successful banking licence application in Latvia, covering the regulator's requirements for cybersecurity, resilience, data governance and risk management.

The result

One clear, board-backed roadmap covering MiCA, DORA, NIS2 and MiFID II
A working security function aligned with risk and compliance leadership
Regulatory obligations across multiple European jurisdictions managed through a single, joined-up approach
A successful banking licence application in Latvia, with the cybersecurity, resilience, data governance and risk management requirements covered