NEN 7510 register: the asset register for information security
The “NEN 7510 register” can mean two things. NEN keeps a public register of organisations with a NEN 7510 certificate. Whether an organisation appears in it depends on the certification body reporting it (NEN ). This page is about the other register: the asset register. It is an overview of the information and systems that hold patient data, with an owner for each item. The measure for the inventory of information and associated assets is control 5.9 in ISO 27002:2022. NEN 7510-2 is based on that ISO standard. The register is the basis for the risk analysis, for the Verklaring van Toepasselijkheid (VvT, Statement of Applicability) and for choosing the measures.
The register is not a one-off document. You need to keep it up to date. During an audit, you must be able to show that it matches reality.
What do you register?
You register every asset that holds or processes information within scope. Think of:
- Information: patient files, lab results, rosters, staff records, contracts.
- Systems and software: the EPD, the electronic client record, the patient portal, the email environment, a network drive.
- Hardware: laptops, tablets, medical equipment with storage, servers, printers with memory.
- Services: cloud environments, external processors, links with other care providers.
- Other resources: removable media such as USB sticks, and rooms where data is kept.
An asset without an owner is a blind spot. ISO 27002:2022 requires every line in the inventory to have an owner, so always fill this in.
Example of a register
This is a fictional example of a physiotherapy practice with one electronic patient record (EPD, elektronisch patiëntendossier) and a cloud email environment:
| Asset | Type | Classification | Owner | Location or supplier | Links | Last check |
|---|---|---|---|---|---|---|
| EPD (care records) | Software and data | Highly confidential | Practice manager | Supplier, cloud in EU | Lab link, referrals via the Landelijk Schakelpunt (LSP, national switch point) | 12 September 2026 |
| Secure email | Service | Confidential | Practice manager | Email supplier | Patients and GPs | 12 September 2026 |
| Reception laptop | Hardware | Confidential | Reception coordinator | Own device, encrypted | EPD via browser | 1 October 2026 |
| Paper archive | Physical | Highly confidential | Treating practitioner | Archive room, locked | None | 5 June 2026 |
| Patient exercise app | Service | Internal | Treating practitioner | External supplier | None | Not yet assessed |
The last row shows what auditors look for. An asset that has not yet been assessed is recorded straight away as an open point. The register does not need to be perfect. It must show that you keep it up to date.
How do you build it?
- Start with the systems. For each system, ask whether it holds patient data. This is the fastest route to a first version.
- Add the information. For each process, add the documents and data flows that are not in a system.
- Assign owners. Each line gets one owner and a substitute.
- Classify. Use a fixed scale, for example public, internal, confidential and highly confidential. Record that scale in your policy.
- Link it to the risk analysis. Every asset in scope must appear in the risk register.
- Set a maintenance rhythm. A fixed check every quarter, plus an extra check for each new supplier or change, works well. The standard does not prescribe a fixed frequency.
Link the register to procurement. A new system or a new supplier that processes patient data should only go live once it is in the register. That is one of the easiest ways to keep it current.
Common mistakes
- Only the known systems. The register contains the EPD and email, but not the Excel lists, the WhatsApp group or the paper archive. Those are exactly the places auditors ask about.
- No owner. “The team” is not an owner. Enter a name or a role.
- A register that does not match reality. A system that was replaced two years ago is still listed.
- No link with the VvT. A measure that refers to an asset that does not exist stands out.
- Too detailed. A register that lists every USB stick in the practice costs more time than it gives back. Choose the level that suits your risks.
What does the auditor ask?
During the external audit, the register may be one of the first documents requested, together with the Statement of Applicability (VvT). The auditor picks a few assets and asks: who owns it, what data is on it, which risk is recorded in the risk register, and when it was last checked. See also the checklist and the mandatory documents.
How it fits with the rest of the standard
The register is the backbone of the management system. If it is right, the risk analysis, the measures and the VvT fit together better. If it is not, you see that in every audit. If you have not started yet, begin with the step-by-step plan, where the register belongs in phase 1.
Additional points to note
- The example table is fictional. The columns are a working method. Decide which fields you need with your certification body.
- The number 5.9 comes from ISO 27002:2022, which NEN 7510-2 is based on. Check the numbering and wording in NEN 7510-2 itself before you adopt your policy.
- The “classification” and “last check” columns in the table are a working method. ISO 27002 does require an owner for each item.
- This register is not the same as the processing register under the GDPR (Dutch: Algemene verordening gegevensbescherming, AVG; Article 30). You can maintain both from the same source, though.