About Andrzej Dudek
GRC and ISMS practitioner with a background in automotive quality, audit coordination and process improvement.
Systems support people - people create value
My work combines ISMS development and maintenance with audit coordination, risk management and process improvement in automotive. I coordinate TISAX preparation and work with process owners and global teams on ISO/IEC 27001 requirements. I initiated a gap analysis against KSC/NIS2 requirements to identify areas requiring further action.
I connect gap analysis and evidence with action owners, follow-up and effectiveness checks. Alongside this work, I develop applications and workflows that improve everyday processes. SecureHaveNET documents my perspective, selected private experiments and lessons learned.
All content on this website reflects my personal perspective and does not represent the views of any organization I am connected with.
From quality to information security
My areas of practice have expanded over 18 years in automotive, including seven years in ISMS alongside quality.
Professional journey
Building on process knowledge to manage risk in industrial environments
My story
Working close to production taught me to ask what went wrong, why it happened and how to prevent it from happening again.
Two books helped shape my thinking along the way: The Toyota Way by Jeffrey K. Liker and Doktryna jakości. Rzecz o turkusowej samoorganizacji by Professor Andrzej Jacek Blikle. They helped me put into words what I value in my work: understanding problems at their source, improving processes and trusting the people who work with them every day.
They also connect with the thought behind my motto: systems support people, and people create value.
I bring those questions into information security: what needs protecting, what can go wrong, and how can we improve the process?
Selected achievements
Information security implementation. Working with the global team, I implemented TISAX requirements in the organisation and was responsible for the local implementation of ISO/IEC 27001. The preparations I coordinated led to independent confirmation that requirements were met within the assessed scope.
Process and documentation automation. I implemented an application supporting the evaluation of training effectiveness and an electronic document approval workflow. Using Power Apps, Power Automate and SharePoint, I automated notifications and reminders.
Digital production records. I replaced paper-based process release records with an electronic solution. I also created a database for documenting changes, with automated notifications and approvals.
OT security & technical practice
From requirements to implementation. I co-developed and helped implement an internal OT security standard, connecting organisational requirements with maintenance and automation practices. My contribution covered policies and procedures, support in selecting security controls, and team training. The work established shared guidelines for asset protection, operational continuity and responsibilities for maintaining OT security.
Technical practice. My private lab complements this experience through experiments with monitoring, backup, SIEM, automation and OT/IoT. These projects help me examine how controls work, understand their limitations and bring technical insight into GRC and ISMS decisions.
Selected private projects: local LLM tests and limitations, OT/IoT station, Wazuh / SIEM and Zabbix + Grafana monitoring.
Education
An engineering foundation in materials, manufacturing processes and technical analysis.
Master of Science in Engineering (M.Sc. Eng.)
2001-2006Silesian University of Technology (Politechnika Śląska)
- Field of study
- Technical and Computer Science Education
- Faculty
- Mechanical and Technological Engineering
- Specialization
- Engineering Materials
Pedagogical preparation
Completed as part of the degree programme, including pedagogical coursework and teaching practice.
Selected Qualifications & Training
Six selected milestones connecting process auditing, information security and technical practice.
Q&A: Experience, Approach & Practice
How do you turn complex requirements into something that actually works in daily operations?
I connect a requirement with the activity it affects, the person responsible and the evidence needed to check it. For an example from my own environment, see how I applied GRC and PDCA to this website.
What is the most common mistake made when implementing standards like ISO 27001 or TISAX ®?
Treating requirements as documentation tasks instead of operational improvements. When the focus is only on “having it written,” systems become disconnected from reality. The real value comes when requirements are embedded into processes and decision-making.
How do you approach audits to make them effective instead of stressful?
I organise the audit programme and coordinate auditors, then connect findings with action owners and effectiveness checks. During an audit, I use evidence and conversations with the people doing the work to understand how the process operates.
How do you balance strict compliance with operational efficiency?
I assess whether an existing process can meet the requirement and what evidence will demonstrate it. I consider the risk, the work needed to maintain the control and the responsibilities involved before proposing a change.
What role does communication play in GRC and industrial cybersecurity?
Coordination depends on people knowing what is required, who owns the action and what evidence is needed. I work across process owners, IT and global teams to make these expectations clear and follow up on progress.
How does your technical lab support your work in management systems?
The OT/IoT station shows how an observed access problem led to password protection for HMI configuration screens. The local LLM project documents tests, recorded answers and limitations. These are private experiments, with the scope of each result stated in the project.
How do you typically approach solving complex problems?
I focus on data and simplicity. Methods like 5Why, supported by facts, are often enough to identify root causes. More advanced tools are useful, but clarity and structured thinking usually bring the fastest results.
What motivates you to keep developing in this field?
The combination of structure and change. Standards provide a framework, but every environment is different. There is always something to improve, optimize, or better understand.