Building resilience on a solid foundation of risk management
From governance to in-depth risk assessments and everything that follows: risk expertise that strengthens your business and decision-making, not just your paperwork.
IT, OT, Operational Risk & Resilience
Information Security
Supply Chain & Third Party Risk
Governance, Risk, Compliance & Audit
Services
IT, OT, Operational Risk & Resilience
A critical process or production line stops. A core system fails. A supplier is breached. Resilience is not about preventing every incident. It is about knowing where you are exposed, what it would cost you and what you will do when it happens.
On paper, systems and processes often appear well in control. In practice, they are usually more vulnerable than thought. I assess IT, OT and operational risk where it actually lives: in your applications, industrial control systems, production environments, and the processes and people that connect them. I have done this inside factories, warehouses and financial institutions across Europe, from a single application to an entire value stream, and I have built the risk methodologies that organizations keep using long after the assessment is done. And I do not stop at the assessment. I design and implement the controls, governance and continuity measures together with your teams, so that resilience becomes part of how you operate rather than a finding in a report. The outcome is a clear picture of your real exposure, a prioritized set of decisions, and a position you can defend to your board, your auditor and your regulator.
Information Security
Information is one of your most valuable assets and one of the easiest to lose. Strong information security is not a tool you buy. It is a capability you build into how your organization works, and one your customers, regulators and auditors will increasingly ask you to prove.
I build and embed that capability with you: an Information Security Management System that fits the size and risk profile of your organization, from policies, procedures and risk assessments to security by design, data privacy under GDPR and awareness that changes behavior. I have led information security teams at Nike and Aegon and know the difference between a framework that looks good in an audit and one that holds up when something goes wrong. Everything is practical and proportionate, aligned with ISO 27001, NIST CSF and IEC 62443 where you need it, and ready for certification or regulatory scrutiny when the moment comes. The result is security that people actually follow instead of something they work around.
Supply Chain & Third Party Risk
Your risk exposure does not stop at your own walls. It extends to every vendor, supplier and partner with access to your systems, data or premises. Whether that is a cloud provider for a financial institution or an OT supplier for an industrial operator, third-party risk is one of the most overlooked attack surfaces.
I help you see where your real exposure lies and manage it before it becomes an incident. That starts in procurement, where the right questions at contracting stage prevent most problems later, and runs through vendor due diligence, third-party risk assessments and ongoing monitoring across your supply chain. I have assessed vendors, partners and data-sharing arrangements across global supply chains and worked inside procurement as a business risk partner, so I know both sides of the table. Together with your teams I build the third-party risk framework that fits your organization and meets the supplier requirements of DORA and NIS2, and I implement it so that it holds up in daily operations.
Governance, Risk, Compliance & Audit
Governance is not a paperwork exercise. It is how resilient organizations know what to do, and how to do it, when it matters. And with NIS2, DORA and the CER Directive now in force, it is also what regulators, auditors and certification bodies will measure you against.
I build the governance that makes that possible: structures, policies, procedures, risk methodologies and control frameworks that keep risk manageable and within the limits you set. From risk appetite and reporting to embedded ways of working, this is governance that fits how your organization actually runs, instead of a binder on a shelf.
And I test whether it holds. Through internal audits, control testing and maturity assessments I show you where you stand today and what it takes to strengthen it, before a regulator or certification body does. When an audit has already handed you a list of findings, I help you remediate them: prioritized, owned and closed, not just logged. I have built risk governance and assessment methodologies for a bank, carried out internal audit work in a global organization and conducted maturity assessments across industries.
The standards and regulations I work with
Not every organization needs all of these. I use them where they fit your risk, your sector and your obligations.
ISO 27001: the international standard for information security management systems
NIST CSF: a widely used framework for managing cybersecurity risk
IEC 62443: the security standard for industrial control systems and OT environments
GDPR: the EU regulation on the protection of personal data
NIS2: the EU directive on cybersecurity for essential and important entities
DORA: the EU regulation on digital operational resilience in the financial sector
CER Directive: the EU directive on the resilience of critical entities
About
I help organizations understand and take control of their risk, from the boardroom to daily operations.
For over 12 years I have worked at the intersection of operational risk, information security and IT and OT risk, for international and domestic organizations in financial services, real estate, retail, logistics and manufacturing.
I hold the CISM, CRISC and CDPSE certifications. Before going independent I led information security and risk teams at Nike and Aegon, where I carried out internal audit work and OT and ICS risk assessments across European supply chains and manufacturing sites.
In 2025 I started Ferspuij Business Consultancy because I wanted to help organizations and the people in them get a grip on their risks. Risk management works best when it is practical, built around the organization it serves and carried through to implementation.
What assessing everything from a single application to an entire factory has taught me is simple: the difference between paper resilience and real resilience is made in execution, not in reports. That is what Ferspuij Business Consultancy stands for.
I am hands-on by nature, and what drives me is straightforward. I get energy from helping people make sense of risk: not as something overwhelming, but as something they understand, own and use to make better decisions.
Let's talk about how I can help you strengthen your risk and security posture.
Experience
Contact
Inquiries
For any inquiries, questions or remarks, fill out the form below or contact me directly by email at ferry@fbcworks.nl or by phone at +31 6 47 00 49 97. Your data is handled as described in the privacy policy.
Head Office
Amsterdam, the Netherlands
Chamber of commerce: 97668583