How long does ISO 27001 certification take?

It depends on the starting point. At a unicorn-status crypto business Thomas Kranz built an information security management system from nothing and the company reached ISO 27001 certification in two months. At a blockchain fintech, ISO 27001:2022 certification came within the first three months.

What does a virtual CISO do?

A virtual or fractional CISO provides senior security leadership without the cost of a full-time executive, including security strategy, risk management, board reporting, supplier and regulator management, and leading certifications such as ISO 27001.

Can you help with DORA, MiCA or NIS2?

Yes. Thomas Kranz has built a single roadmap covering MiCA, DORA, NIS2 and MiFID II for a Europe-wide crypto fintech, and delivered MiCA and DORA registration and NIS2-ready incident management for a blockchain fintech.

Building an award-winning cyber R&D lab and growing a consulting practice by 160%

Sector: Technology consulting
Market verticals: Professional services, cybersecurity consulting, enterprise and public sector clients
Client: A fast-growing technology consultancy
My role: Director, Cyber Lab; Head of Security Operations and Incident Response; Security Strategy Consultant
Period: 2017 to 2019
Award: Cyber Security Consulting Practice of the Year 2019

The challenge

A rapidly growing technology consultancy wanted to build a distinctive cybersecurity offering, win new business, and find the people to deliver it, all in a fast-moving environment.

What I did

I joined as a security strategy consultant and progressed to Head of Security Operations and Incident Response, then Director of the Cyber Lab. With a £1 million budget I created an award-winning cyber research and development function, introducing new research and analysis methods. I defined the go-to-market strategy for a new consulting business unit, sold the service to clients and embedded it. I also transformed the interview process to attract and hire stronger candidates, and presented as keynote speaker and subject matter expert at industry events and in the national press.

The result

£5 million of new sales pipeline identified, with go-to-market strategies in place
More than £1 million of revenue from the new consulting business unit
160% growth in cyber practice headcount within 18 months
An award-winning cyber research function, recognised as Cyber Security Consulting Practice of the Year 2019

What clients said

“Tom is a highly experienced consultant who is constantly challenging the way we do things and an exemplar of what consultants could aspire to be. His ability to communicate technical topic into a clear and concise way for any stakeholder to understand is something to aspire to.”

— Cyber team leader, technology consultancy