About

I am an information security and data protection professional with many years of experience working with management systems, security requirements, risk management, and regulatory compliance. My work has included implementing and maintaining Information Security Management Systems (ISMS) and Data Protection Management Systems (DSMS), assessing risks, reviewing technical and organisational measures, developing policies and procedures, preparing organisations for audits, and supporting the practical implementation of ISO/IEC 27001. I am also certified as an ISO/IEC 27001 Lead Implementer, ISO/IEC 27001 Lead Auditor, ISC2 Certified in Cybersecurity (CC), and a TÜV-certified Data Protection Officer.

My approach to information security is practical. Standards, controls, policies, and risk assessments only have value when they work in the real organisation behind them. Through this website, I write about information security, cybersecurity, ISO 27001, auditing, risk management, and related topics from the perspective of someone who works with these subjects in practice. The aim is to explain them clearly, examine how they apply in real environments, and share experience that may be useful to other practitioners, consultants, auditors, and organisations.