How long does ISO 27001 certification take?

It depends on the starting point. At a unicorn-status crypto business Thomas Kranz built an information security management system from nothing and the company reached ISO 27001 certification in two months. At a blockchain fintech, ISO 27001:2022 certification came within the first three months.

What does a virtual CISO do?

A virtual or fractional CISO provides senior security leadership without the cost of a full-time executive, including security strategy, risk management, board reporting, supplier and regulator management, and leading certifications such as ISO 27001.

Can you help with DORA, MiCA or NIS2?

Yes. Thomas Kranz has built a single roadmap covering MiCA, DORA, NIS2 and MiFID II for a Europe-wide crypto fintech, and delivered MiCA and DORA registration and NIS2-ready incident management for a blockchain fintech.

GDPR-compliant data governance and ISO 27001 for an FCA-regulated business

Sector: Financial services
Market verticals: FCA-regulated financial services, payments, data privacy
Client: An FCA-regulated financial services business
My role: Chief Information Security Officer and Data Privacy Officer
Period: 2023 to present

The challenge

An FCA-regulated business needed security and data governance that satisfied ISO 27001 and PSD2, kept it on the right side of GDPR, and could keep pace with changes to the standards.

What I did

I revised and implemented the IT security framework and a GDPR-compliant data governance framework. When the ISO 27001 standard was updated, I moved the business across to the new version, with a revised and improved risk management framework and refreshed data governance policies. I delivered Data Protection Impact Assessments and have supported the senior leadership team on GDPR and data governance questions as they come up. Throughout, I have worked to support the firm's existing FCA authorisation and its ongoing compliance.

The result

A security and data governance framework that meets ISO 27001 and PSD2 requirements
A smooth transition to the current ISO 27001 standard with stronger risk management
Senior leaders with a dependable source of advice on privacy and data protection
The firm's existing FCA authorisation supported, with security and data governance compliance maintained