About

I help manufacturers of connected products turn cybersecurity regulation into secure products, defensible compliance evidence, and workable engineering processes.

My work combines product engineering, security architecture, certification, and standards development. I have more than twenty years of experience across Philips, NXP, and Signify, working on connected products and the security processes behind them.

My current focus is the Cyber Resilience Act (CRA) and the standards that support its implementation. I contribute to CRA and Radio Equipment Directive Delegated Act (RED DA) standards through CEN-CENELEC and ETSI, and help connect regulatory requirements with engineering practice.

How I can help

I can help your team to:

• Determine how the CRA, the RED DA, and related standards apply to your products
• Classify products and define a practical conformity-assessment route
• Build the cybersecurity risk assessment and technical evidence needed for compliance
• Strengthen product-security architecture, lifecycle processes, and vulnerability handling
• Prepare processes for CRA vulnerability and incident reporting
• Plan a practical transition from RED DA requirements to the CRA
• Deliver a technical talk or webinar on connected-product security and compliance

Experience and expertise

My experience connects three areas that are often handled separately: engineering, product security, and regulation.

Product security architecture and lifecycle management

Security risk assessment, vulnerability handling, hardware-based security, and network access control, including secure elements, trusted platform modules, trusted execution environments, and IEEE 802.1X.

Regulation, standards, and conformity assessment

Practical experience with the CRA and RED DA, together with frameworks, standards, and guidance including the IEC 62443 series, EN 303 645, NIST SP 800-82, and UL 2900.

Connected-product engineering

Experience across connected lighting and building automation, automotive systems, and mobile devices. This includes LiFi, NFC commissioning, vehicle-to-vehicle and vehicle-to-infrastructure communication, telematics, and over-the-air updates, using technologies such as Zigbee, Matter, Wi-Fi, and Bluetooth.

Contributions to standards

• EN 18031-1/2/3:2024 - I played a key role in developing these CEN-CENELEC cybersecurity standards, helping manufacturers assess conformity under the RED DA.
• Zigbee Direct - I contributed to this specification, which is now part of the Zigbee Core specification.
• ITU-T LiFi and power-line communication standards - I contributed to these standards, including enterprise security based on IEEE 802.1X network access control.
• Fairhair specification - I contributed to this security architecture for IoT in commercial buildings.

Standardization roles

CEN-CENELEC

At CEN-CENELEC, I represent the Dutch national committee through the Cybersecurity & Privacy standards committee and NEC 65.

• JTC13: Working on RED DA standards in WG 8 and CRA horizontal standards in WG 9.
• TC65X: Working on CRA standards based on IEC 62443 in WG 3.
• TC205: Working on IT security for home and building systems in WG 20.

ETSI

I act as liaison between CEN-CENELEC JTC13 WG 9 and ETSI. At ETSI, I contribute mainly to the CRA standard for smart home products with security functionalities, such as door locks, cameras, and alarms (EN 304 632).

Connectivity Standards Alliance

I serve on the Security Advisory Group and the Product Security Working Group Steering Committee. I also act as liaison between the Connectivity Standards Alliance and CEN-CENELEC.

International Telecommunication Union

My contributions include work on ITU-T G.9991.

Publications and patents

• ELIoT: enhancing LiFi for next-generation Internet of Things - EURASIP Journal on Wireless Communications and Networking
• Security Architecture for the Internet of Things (IoT) in Commercial Buildings - White paper
• A selection of my patent work is listed on Justia.

Let’s talk

Tell me what you are preparing, where you are blocked, and what kind of help you need. If you are working through a product-security challenge, preparing for the CRA, or looking for a speaker who connects regulation with engineering practice, get in touch.