How long does ISO 27001 certification take?

It depends on the starting point. At a unicorn-status crypto business Thomas Kranz built an information security management system from nothing and the company reached ISO 27001 certification in two months. At a blockchain fintech, ISO 27001:2022 certification came within the first three months.

What does a virtual CISO do?

A virtual or fractional CISO provides senior security leadership without the cost of a full-time executive, including security strategy, risk management, board reporting, supplier and regulator management, and leading certifications such as ISO 27001.

Can you help with DORA, MiCA or NIS2?

Yes. Thomas Kranz has built a single roadmap covering MiCA, DORA, NIS2 and MiFID II for a Europe-wide crypto fintech, and delivered MiCA and DORA registration and NIS2-ready incident management for a blockchain fintech.

Cybersecurity case studies

Real results from CISO, consulting and advisory work, from a start-up with no security function to a company certified to ISO 27001 in two months.

I have spent more than 30 years in cybersecurity as a CISO, a consultant and an advisor, mostly for growing and regulated companies in fintech, cryptocurrency, financial services and technology. These case studies show what that work looked like in practice, what I did, and what changed as a result.

Client names are confidential, so each case study describes the sector and market the company operated in instead. Each one covers the problem the company had, what I did about it, and the results, with the numbers where I can share them. If one looks like your situation, book a free 30-minute call and we can talk it through.

Featured Result

ISO 27001 from nothing in two months. At a unicorn-status crypto business I built an information security management system from scratch and took the company to certification in two months, which won the Gold Globee® award for Cybersecurity Consultant of the Year 2023. Read the case study

“Tom was a driving force in the company obtaining its ISO 27001 within a record time.”

— Senior HR Leader, cryptocurrency business

Results at a glance:

ISO 27001 certification in two months at a crypto unicorn, and in three months at a blockchain fintech
Contributed to successful banking and regulatory licence applications in five jurisdictions (Jersey, Malta, the Netherlands, France and Latvia), and supported an existing FCA authorisation in the UK
One roadmap covering MiCA, DORA, NIS2 and MiFID II for a Europe-wide crypto fintech
A third-party breach blocked in the first 15 days, avoiding a regulatory fine of £80,000
A contract extension worth more than €100 million helped by C-suite workshops at a global manufacturer
Consulting practice headcount up 160% in 18 months

Featured Case Studies

Case Studies

ISO 27001 from nothing in two months, an award-winning security programme and two nation-state attackers caught in hiring

A unicorn crypto firm with no ISMS needed to prove its security. I built one from scratch and took it to ISO 27001 certification in two months, which won the Globee Cybersecurity Consultant of the Year award.

Read more →

ISO 27001 in three months and banking licence support for a blockchain fintech

A blockchain fintech needed enterprise security, banking licence evidence in two countries and compliance with new EU rules. ISO 27001:2022 certification came within three months, alongside MiCA and DORA registration.

Read more →

A regulator-ready security function for a Europe-wide crypto fintech

A regulated crypto fintech faced MiCA, DORA, NIS2 and MiFID II at once. I built one two-year roadmap to ISO 27001 that supports every requirement, and a security function that stands up to regulators.

Read more →

Security due diligence and virtual CISO support for private equity portfolios

Private equity firms need to know what cyber risk they are buying. I carried out pre-acquisition security due diligence, then acted as vCISO to portfolio companies, in plain language an investment team can act on.

Read more →

A vulnerability management transformation that helped win a nine-figure contract extension

A global manufacturer needed to transform how it found and fixed vulnerabilities. I led the vulnerability management workstream, and the C-suite workshops I ran helped win a major contract extension.