How long does ISO 27001 certification take?

It depends on the starting point. At a unicorn-status crypto business Thomas Kranz built an information security management system from nothing and the company reached ISO 27001 certification in two months. At a blockchain fintech, ISO 27001:2022 certification came within the first three months.

What does a virtual CISO do?

A virtual or fractional CISO provides senior security leadership without the cost of a full-time executive, including security strategy, risk management, board reporting, supplier and regulator management, and leading certifications such as ISO 27001.

Can you help with DORA, MiCA or NIS2?

Yes. Thomas Kranz has built a single roadmap covering MiCA, DORA, NIS2 and MiFID II for a Europe-wide crypto fintech, and delivered MiCA and DORA registration and NIS2-ready incident management for a blockchain fintech.

ISO 27001 from nothing in two months, an award-winning security programme and two nation-state attackers caught in hiring

Sector: Financial services and cryptocurrency
Market verticals: Cryptocurrency, decentralised finance, high-growth technology
Client: A unicorn-status cryptocurrency business
My role: Head of Cybersecurity / DPO
Period: 2022 to 2023
Award: Gold Globee® Winner, Cybersecurity Consultant of the Year 2023

The challenge

A fast-growing, unicorn-status cryptocurrency business had a £1 million annual security budget, no mature incident management, no information security management system, and a hiring pipeline that was attractive to hostile actors. It needed to show investors, partners and regulators that its security could be trusted, and it needed to do that quickly.

What I did

I took charge of the cybersecurity budget, hired and trained a team of four, and created the security tooling, operational procedures and risk management policies. I built an information security management system (ISMS) from scratch and took the company through ISO 27001 certification, starting from nothing and finishing in two months. I introduced new incident management processes, reporting directly to the C-suite. A full total cost of ownership review let me renegotiate discounts and terms and consolidate tools that overlapped. I also redesigned security reviews and background checks for candidates, and, as Head of Cybersecurity and DPO, contributed to the company's successful banking licence application in Jersey, covering the regulator's requirements for cybersecurity, resilience, data governance and risk management.

The result

ISO 27001 certification achieved from a standing start in just two months, with an ISMS built from scratch
Recognised with the Gold Globee® award for Cybersecurity Consultant of the Year 2023, in large part for that ISO 27001 delivery
A third-party data breach blocked within my first 15 days, which also avoided a regulatory fine worth £80,000
A 20% saving on monthly security tooling costs
Two nation-state-sponsored attackers identified during the hiring process before they could get inside the company
A successful banking licence application in Jersey, with the cybersecurity, resilience, data governance and risk management requirements covered

What clients said

“Tom was a driving force in the company obtaining its ISO 27001 within a record time… Cybersecurity can be a daunting topic but with Tom at the helm, it’s reassuring knowing that he can break down such a complex subject whilst keeping his audience engaged.”

— Senior HR Leader, cryptocurrency business

“Tom has an uncanny ability to not only set up bespoke cybersecurity infrastructures for start-ups but also has the strategic mindset and leadership to future proof systems as much as possible. Tom was always thinking one step ahead, prewarning on events yet to happen – so that when they did the company was in a better position to deal with them.”

— Senior Operations Leader, cryptocurrency business