The NEN 7510 audit process
The external audit is the last step towards your NEN 7510 certificate. An independent auditor from an accredited body checks whether your information security management system meets the requirements of NEN 7510. This page explains how the audit works and how to prepare. Work through the step-by-step plan first, so your preparation is complete.
An audit does not only review documents. It mainly checks whether your information security works in daily care practice. The auditor checks technical measures and speaks with staff.
The NEN 7510 audit process in brief
| Stage | What happens | Outcome |
|---|---|---|
| Phase 1 | Document review (ISMS, risk analysis) | Go or no-go for phase 2 |
| Phase 2 | Implementation audit on site | Certification recommendation |
| Surveillance audit | Annual check audit | Certificate maintained |
| Recertification | Full reassessment in year 3 | Certificate renewed |
The audit cycle
NEN 7510 certification follows a three-year cycle with annual audits.
Year 1: initial certification audit The first, comprehensive audit that decides whether you get the certificate. It has two phases.
Year 2: surveillance audit 1 A shorter audit that checks whether you still comply and whether you are making improvements.
Year 3: surveillance audit 2 Similar to year 2.
Year 4: recertification audit A more extensive audit that decides whether the certificate is renewed. After that, the cycle starts again.
The NEN 7510 audit step by step
Phase 1: document review
The auditor reviews your documentation before coming on site. The aim is to establish whether your system is set up well enough on paper to move on to phase 2.
The auditor looks at your information security policy, scope and context, risk analysis and risk treatment, the Verklaring van Toepasselijkheid (VvT, Statement of Applicability), the most important procedures, and the results of internal audits and management review.
Phase 1 can often take place remotely. The auditor studies the documents and asks questions by video or phone. This typically takes half a day to two days.
After phase 1, you receive a report with findings. If there are major gaps, you must fix them before you can move on to phase 2. For minor points, you can work on them in parallel.
Phase 2: implementation audit
The auditor comes on site and checks whether you do in practice what you have documented. This is the core of the certification audit.
The auditor works with several methods:
Interviews with staff at different levels, from management to operational staff. Do people know the policy? Do they know their responsibilities? Do they follow the procedures?
Observations of the actual situation. Are server rooms locked? Are clean desk rules followed? Is logging switched on?
Document review of records and evidence. Training records, the incident log, backup tests, audit reports.
Sample checks to test whether measures work. The auditor picks a few examples at random and digs deeper.
The length of phase 2 depends on the size of your organisation. For a small care organisation, this is 1 to 2 days. For a large hospital, 5 to 10 days or more. With several locations, the auditor visits a selection.
The auditor is not your opponent. A good auditor wants to help you improve and looks for evidence that your system works. Be open and honest, including about things that could still be better.
What does the auditor ask in a NEN 7510 audit?
The auditor checks all requirements of NEN 7510. In practice, the focus is on a number of key points. Expect questions such as: show us your risk analysis, how do you grant access based on the treatment relationship, show us your logging, when was the last backup test? Below are the topics the auditor will probe.
Management commitment
Is management really involved, or is this a paper exercise? The auditor speaks with management and looks for evidence of commitment: policy documents, minutes of management reviews, allocated resources.
The risk analysis
Have you identified the risks properly? Is the method logical? Have you included risks specific to healthcare? Are the assessments realistic? The risk analysis is the foundation of your system.
The Statement of Applicability
Are your choices right? If you have not selected a measure, is that well justified? Does the selection match your risk analysis? The auditor checks the logic behind your choices.
Implementation of measures
Have the selected measures actually been implemented? Do they work? The auditor takes samples: show us how access management works, show us the logging, when was the last backup test?
Awareness and competence
Do staff know what is expected of them? Have they been trained? The auditor speaks with staff and asks about their knowledge and awareness.
Continuous improvement
Does the improvement cycle work? Have internal audits been carried out? Have findings been addressed? Has there been a management review with concrete decisions?
Healthcare-specific requirements
The auditor pays extra attention to healthcare-specific aspects: logging of access to patient data, access based on the treatment relationship, security of medical equipment, patient rights.
Findings and nonconformities in the NEN 7510 audit
After the audit, the auditor records the findings. These are categorised.
Major nonconformity (grote afwijking)
A situation in which a requirement of the standard is not met, or is met very inadequately. For example: no risk analysis carried out, no management review held, a critical measure entirely missing.
If you have a major nonconformity, you do not receive the certificate until you have resolved it. You are given time to correct it, after which the auditor returns to check.
Minor nonconformity (kleine afwijking)
A situation in which a requirement is only partly or occasionally not met. For example: one document not up to date, one employee not trained, one measure not fully working.
If you have minor nonconformities, you can still receive the certificate. However, you must resolve the nonconformity and provide evidence within an agreed period, typically 90 days.
Opportunity for improvement (verbeterpunt)
Observations where the auditor sees room for improvement but which are not a formal nonconformity. You are not obliged to act on these, but they are valuable suggestions.
Three or more minor nonconformities in the same area can together form a major nonconformity. A pattern of minor nonconformities can also point to a systemic problem.
Which documents do you need for a NEN 7510 audit?
The auditor wants evidence that your system works. Make sure these documents are complete, up to date and approved. Use the checklist below as a final check before the audit.
| Document | What the auditor checks |
|---|---|
| Information security policy | Up to date, approved and known to staff |
| Scope and context | Clearly defined and suited to your organisation |
| Risk analysis and risk treatment | Recently carried out and documented |
| Statement of Applicability (VvT) | Complete, with justification for each measure |
| Internal audit reports | Carried out, with nonconformities addressed |
| Management review | Held, with minutes and concrete decisions |
| Training and awareness records | Shows that staff have been trained |
| Access logging (NEN 7513) | Access to patient records is logged |
| Incident register | Incidents recorded and handled |
| Backup and recovery tests | Recently tested, with evidence |
For the substance behind these documents, see the requirements of NEN 7510 and the approach in the step-by-step plan.
Preparing staff
Tell staff that an audit is coming. Explain what the purpose is and that the auditor may ask questions. Staff do not need to know everything, but they must be aware of the policy and their own responsibilities.
Do not panic: the auditor understands that not everyone has everything at their fingertips. Honesty and a basic knowledge of your own work are enough.
Practical preparation
Reserve a room for the auditor. Make sure relevant staff are available for interviews. Prepare the documentation so you can quickly show what the auditor asks for.
Appoint someone as the auditor’s host. This person is the point of contact, arranges the schedule and makes sure the auditor gets what they need.
During the audit
The opening meeting
The audit begins with an opening meeting. The auditor introduces themselves, explains the approach and confirms the schedule. You briefly present your organisation and your ISMS.
The audit days
The auditor works through their programme. This alternates between interviews, observations and document review. Do not try to steer or hide things. Be helpful and open.
If the auditor asks something you cannot show straight away, say so honestly. “I need to look that up” is better than a wrong answer.
The closing meeting
At the end, the auditor presents their provisional findings. You have the chance to ask questions and, if needed, provide additional evidence. The official report follows later in writing.
After the audit
The audit report
Within a few weeks, you receive the official audit report with all findings. Check that it matches what was discussed in the closing meeting.
Resolving nonconformities
For each nonconformity, you make an action plan. You analyse the cause, decide on the corrective measure and implement it. You provide evidence to the auditor.
Certification decision
The certification body assesses the audit report and your response to the nonconformities. If the outcome is positive, you receive the certificate. This typically takes a few weeks after any nonconformities have been resolved.
Surveillance audits
After initial certification, annual surveillance audits follow. These are shorter and less extensive than the initial audit.
A surveillance audit checks whether your system still works and improves, whether you have resolved nonconformities from earlier audits, whether you are running the improvement cycle with new internal audits and management reviews, and whether no new major problems have arisen.
The auditor selects part of the standard to check. Over the three-year period, everything is looked at at least once.
Recertification audit
After three years, the recertification audit follows. This is more extensive than a surveillance audit but more compact than the initial audit. The auditor reviews the whole system again and assesses whether the certificate can be renewed.
Plan recertification well in advance. If the current certificate expires before recertification is complete, your certification lapses.
Choosing a NEN 7510 certification body
Choose a body accredited for NEN 7510 by the Raad voor Accreditatie (RvA, Dutch Accreditation Council) . Accredited bodies include Kiwa, DNV, TÜV, DEKRA and LRQA.
Ask for quotes from several bodies and do not compare on price alone. The auditor’s experience in the healthcare sector makes a difference. Use the comparison points for certification bodies to make a fair choice.
Next step
Read the frequently asked questions about NEN 7510, or see the step-by-step plan for the route to certification. If you want to run the internal audit yourself as preparation, read how to approach the internal NEN 7510 audit in a healthcare setting.
Want to see what an audit day looks like in practice? Read the example audit day. Common mistakes per part are listed in common mistakes in the NEN 7510 audit.
Practical next steps
First, work out which evidence you need. Read the difference between an independent assessment and NEN 7510 certification. Already have a certificate? Use the transition plan to NEN 7510:2024 to plan the switch with your organisation.