RG 1058/2025 → ISO 27001:2022 — VASP Control Crosswalk
Argentina's Virtual Asset Service Provider framework (CNV RG 1058/2025) mapped article-by-article to ISO/IEC 27001:2022 controls — a sample of the full crosswalk.
Andrés Cortés
Virtual CISO & Security Advisory · Fintech & Crypto · Latin America
I help fintech and crypto companies build security and compliance functions that satisfy regulators and pass audits — without slowing the business down.
Most recently Argentina CISO at Bitso, Latin America's largest crypto exchange, I ran security governance and a portfolio of 60+ concurrent GRC initiatives at exchange scale, with direct, working relationships across Argentine regulators. I bring that same rigor to your team on a fractional basis, with hands-on depth across Argentina, Mexico, and Brazil.
What I bring
- Exchange-scale security governance and GRC.
- Live experience with LatAm fintech & crypto regulation (AR / MX / BR).
- ISO 27001 & SOC 2 delivery, data-privacy programs, VASP/AML compliance.
- Hands-on incident response, not just slideware.
Certifications: CISM · PMP · ISC2 CC · CSPO · Google Cloud Digital Leader (AWS Certified Cloud Practitioner in progress).
Services
Regulatory coverage
Fintech, crypto/VASP, AML/CFT, and data-protection frameworks across the region's three defining markets.
Selected work
Standing up VASP compliance under a new national framework
Led the security and compliance workstream to meet a new Virtual Asset Service Provider framework on a regulator deadline, alongside an ISO 27001 certification.
Outcome: Evidence packages delivered within regulator deadlines; ISO 27001 achieved without slowing product releases.
Crypto-Asset Regulation in Argentina: A Cybersecurity Analysis of CCSS Alignment with CNV Resolution 1058/2025
A working paper mapping Argentina's VASP framework (CNV RG 1058/2025) against the CryptoCurrency Security Standard (CCSS), and tracing the country's crypto-regulatory evolution and its information-security requirements.
Let's talk
Fractional CISO, regulatory & VASP readiness, ISO 27001 / SOC 2, or a specific security problem.