Andrea Cardinali

I am Andrea Cardinali, an information security professional with over ten years of experience in demanding sectors: healthcare, government, education, and tech. Working from Rijswijk, I operate as an independent consultant on assignments at the intersection of information security, governance, and compliance.

Since 2016, I have worked for organizations such as Erasmus MC, UWV, Holland Casino, and Booking.com, as well as for various hospitals and educational institutions. Despite the differences in these environments, my objective remains the same: to ensure that information security is not just correct on paper, but effective in practice. Policies that end up in a drawer protect no one. That's why I translate frameworks into workable agreements, involve people in the 'why,' and bring structure where it's lacking.

The assignments that energize me are those where I make a visible difference. Setting up an ISMS that the organization can sustain itself. Guiding an ISO 27001 project to certification. Sharply advising management on risks that truly matter. Building security awareness that goes beyond an annual e-learning. My conviction in this is: good security starts with understanding and trust, not with technology and rules.

My specializations include: ISO 27001/27002 implementations, BIO 2.0 within government agencies, NIS2 compliance, GDPR compliance, risk management, asset management, and business continuity management. I manage and build ISMS environments, coordinate internal and external audits, and work with tools like Trustbound, GRC Control, and RiskID. Complex environments with many stakeholders are not an obstacle for me, but my natural working field.