How long does ISO 27001 certification take?

It depends on the starting point. At a unicorn-status crypto business Thomas Kranz built an information security management system from nothing and the company reached ISO 27001 certification in two months. At a blockchain fintech, ISO 27001:2022 certification came within the first three months.

What does a virtual CISO do?

A virtual or fractional CISO provides senior security leadership without the cost of a full-time executive, including security strategy, risk management, board reporting, supplier and regulator management, and leading certifications such as ISO 27001.

Can you help with DORA, MiCA or NIS2?

Yes. Thomas Kranz has built a single roadmap covering MiCA, DORA, NIS2 and MiFID II for a Europe-wide crypto fintech, and delivered MiCA and DORA registration and NIS2-ready incident management for a blockchain fintech.

More than £5 million of new business, £2 million saved and an 18-month security audit, early in my career

Sector: Technology vendor and financial services
Market verticals: Cloud platform software, financial services, retail, enterprise infrastructure
Client: A cloud platform software vendor and a global investment management firm
My role: Principal Field Engineer and Client Solutions (software vendor); Enterprise Solutions Architect and VCS Consultant (financial services)
Period: 2010 to 2017

The challenge

Early in my career I worked on two very different problems. A cloud platform software vendor needed senior technical people who could turn new technology into business for its clients and its own order book. A global investment management firm needed to consolidate a large database estate, cut its licensing and running costs, and then secure and modernise its infrastructure, all in a regulated environment where downtime was not an option.

What I did

At the software vendor I was one of only three platform specialists in EMEA. I led proof-of-concept deployments for new clients, and then moved into a client solutions role, where I worked with C-suite executives to plan transformation roadmaps and grew relationships with existing accounts across financial services and retail. At the investment firm I started by designing and building three five-node, multi-site, five-nines clustered solutions that allowed it to consolidate its whole database estate, taking the project from the first design through to handover to the support teams and leading a virtual team with very varied skill levels. I then became its Enterprise Solutions Architect, with responsibility for enterprise infrastructure solutions. I carried out an 18-month audit and internal penetration test of the firm's entire web infrastructure, assessed third-party testers, helped it prepare for large-scale denial of service attacks and advanced persistent threats, and architected a private internal cloud, with a platform migration roadmap that included the organisational changes it needed.

The result

£3 million of new business delivered in a client solutions role, plus over £2 million of new client business from proof-of-concept deployments, so more than £5 million in total
£2 million saved in licensing and operating costs by consolidating a database estate onto three five-node clusters
An 18-month audit and penetration test covering a global investment manager's entire web infrastructure, with recommendations to secure and strengthen it
Three multi-site clustered systems designed to five-nines availability, delivered from first design to handover to support teams
A private internal cloud and platform migration roadmap delivered end to end, including the changes needed in management structure and staff skills
One of three platform specialists in EMEA, presenting talks and demonstrations at roadshows, conferences and customer events