CISO

JOB DESCRIPTION AND RESPONSIBILITIES DOCUMENT
Information Security and Data Protection
Officer
Chief Information Security Officer / Data Protection Officer (CISO / DPO)
This document defines the duties, authority, and responsibilities of the Information Security and
Data Protection Officer position within a Virtual Asset Service Provider (VASP) subject to VARA
regulations. The document is general in nature and does not contain information relating to any
specific company, product, individual, or internal policy. Regulatory references are made to the
VARA Rulebooks in force as of the date of reference.
1. Position Profile
Position Information Security and Data Protection Officer (CISO / DPO)
Function Control function responsible for information security, cybersecurity, and
personal data protection
Reporting Direct access to the Board of Directors; participation in the relevant Board
committee
Working Model Full-time employee or outsourced arrangement in accordance with VARA’s
outsourcing provisions
Regulatory Status Member of Senior Management; subject to VARA Fit & Proper assessment
Independence Requirement Cannot be the same individual as the Compliance Officer
2. Purpose and Scope of the Role
The CISO / DPO is an independent control function responsible for technology governance,
information security, cybersecurity, wallet and cryptographic key security, smart contract security,
protection of confidential information, and personal data protection.
The purpose of the role is to protect the integrity, confidentiality, and availability of the company’s
systems, customer platform, wallet infrastructure, cryptographic keys, smart contracts, personal
data, and confidential business information; identify and mitigate technology and cyber risks; ensure
timely response to incidents; and ensure that required notifications are made to the regulator.
3. Regulatory Position and Independence
• The CISO function is mandatory under VARA regulations and may not be combined with the
Compliance Officer role in the same individual (Technology and Information Rulebook I.I.1).
• The role holder must possess sufficient capacity, experience, and independence and must not have
any conflicts of interest.
• The role holder may not undertake operational duties that determine the purposes and means of
personal data processing. This is intended to preserve independence from a data protection
perspective.
• Where the position is outsourced, the appointed individual must accept personal responsibility for
the duties and must be subject to the company’s governance, reporting, and incident management
framework.

4. Duties and Responsibilities
4.1 Event-Based and Immediate Actions
• Cybersecurity incident – including phishing, malware, unauthorized access, wallet anomalies, or
smart contract exploitation – detection, classification, containment, root cause analysis, and
implementation of corrective actions.
• Material cybersecurity incident or event triggering the business continuity plan – notification to
VARA within no later than 72 hours (Technology and Information Rulebook I.K.1).
• Personal data breach – assessment of scope and impact; support for notification to VARA no later
than 24 hours after notification is made to the data protection authority or affected individual.
• Loss or compromise of a wallet or cryptographic key – activation of the emergency response
procedure, disabling affected keys, and re-keying.
• In the event of suspected exploitation or key compromise, pausing the smart contract and requiring
written approval before returning it to a clean operational state.
• Security and privacy due diligence before introducing a new system, product, blockchain network,
wallet infrastructure, or service provider.
• Conducting a Data Protection Impact Assessment (DPIA) before commencing any new high-risk data
processing activity.
• Handling data subject requests – including access, rectification, erasure, and objection – within the
legally required timeframe after identity verification.
• Reporting any significant finding or risk to Senior Management and the Board without waiting for
the next periodic reporting cycle.
4.2 Ongoing Activities
• Reviewing and prioritizing alerts received from security monitoring infrastructure, including SIEM,
endpoint systems, cloud environments, and wallet infrastructure.
• Evaluating privileged access requests in accordance with the authorization matrix and
segregation-of-duties principles.
• Verifying security controls for critical wallet transfers and smart contract administrative operations.
• Tracking open security findings and corrective actions.
• Coordinating with technology, compliance, legal, and operational functions and responding to
privacy, security, and data processing questions.
4.3 Periodic Activities
Monthly
• Review open vulnerability and penetration testing findings.
• Sample privileged access lists and wallet transaction approval records.
• Test backup and restoration controls.
• Assess third-party security and privacy findings.
• Present a summary of Key Risk Indicators (KRIs) and control effectiveness to Senior Management.
Quarterly
• Present a report to the Board or relevant committee covering the technology and cyber risk profile,
significant incidents, outstanding findings, wallet/key/smart contract risks, third-party risks, and
business continuity preparedness.
• Update the technology and cybersecurity risk register.
• Re-certify privileged access.
• Update the personal data inventory and data flow map.
• Conduct a tabletop exercise or thematic security test.
• Perform a comprehensive review of the technology governance and risk assessment framework,
cybersecurity policy, and data protection compliance program.
• Coordinate penetration testing, vulnerability assessments, and independent smart contract audits
(Technology and Information Rulebook I.E.1).
• Conduct business continuity and disaster recovery testing and update the plan (Technology and
Information Rulebook I.H.1).
• Renew due diligence for critical service providers.
• Conduct mandatory information security and data protection training.
• Complete the role holder’s own suitability and conflict-of-interest assessment (Company Rulebook
III.G.1).
• Present the annual technology, security, and data protection assessment report to the Board
4.4 Cryptographic Key, Wallet, and Smart Contract Security
• Prepare and maintain the cryptographic key and wallet management policy and submit changes for
Board approval.
• Design and oversee processes for key generation, storage, backup, recovery, and destruction,
including multi-signature mechanisms and approval thresholds.
• Periodically audit wallet access privileges; verify that departing personnel have been removed from
all approval groups; and reconcile the access register against personnel records.
• Define and audit post-deployment governance of smart contracts, including administrator keys,
mint/burn keys, pause keys, upgrade keys, key ownership, storage methods, and approval
thresholds.
• Even where smart contract development is outsourced, ensure that post-deployment key and
authorization governance remains within the company and is subject to independent security
review.
4.5 Personal Data Protection
• Establish and maintain the personal data protection compliance program, including maintenance of
the data inventory and records of processing activities.
• Conduct Data Protection Impact Assessments (DPIAs) and oversee the legal basis for cross-border
data transfers.
• Operate processes relating to data subject rights and monitor data retention periods.
• Verify that contracts with data processors contain appropriate data protection provisions.
5. Authority and Independence
• Performs duties using independent professional judgment and has the right to access all relevant
systems, records, personnel, and service providers.
• Has direct access to Senior Management and the Board and may report significant risks directly to
the Board without obtaining prior approval.
• May request the suspension of any system, transaction, or release that carries unacceptable risk.
• Must promptly disclose any actual or potential conflicts of interest.
• Must be provided with sufficient budget, resources, and personnel to perform the role effectively. If
the role holder considers the allocated resources insufficient, this must be reported to the Board.
6. Required Qualifications
• Bachelor’s degree in information security, cybersecurity, computer or software engineering,
information systems, law, data protection, or a related field.
• Strong professional experience in cybersecurity, information security, technology risk, or data
protection. Experience in a regulated financial institution, fintech company, or VASP environment is
preferred.
• Practical knowledge of cybersecurity governance, risk assessment, incident response, business
continuity, and third-party risk management.
• Experience in privacy compliance, DPIAs, data subject rights, and cross-border data transfer
processes.
• Technical understanding of risks related to blockchain, DLT, smart contracts, wallets, and
cryptographic keys.
• Knowledge of applicable personal data protection legislation.
• Ability to report effectively at Senior Management and Board level; advanced English proficiency.
• High ethical standards and professional reputation; ability to successfully complete background
screening and regulatory suitability assessments.
• Preferred certifications: CISSP, CISM, CRISC, CCSP, ISO/IEC 27001 Lead Implementer or Auditor,
ISO/IEC 27701, CIPP/E, CIPM, CIPT, CDPO, and blockchain or smart contract security certifications.
Note: VARA regulations do not prescribe a specific minimum number of years of experience for this
role. Any experience threshold is determined by the employer.
7. Conflicts of Interest
The role holder must disclose:
• Simultaneous employment or appointment at another Virtual Asset Service Provider or regu