NEN 7510 checklist: are you ready for certification?
This checklist helps you quickly see where you stand against NEN 7510 . For each clause of the standard, it sets out the core question the auditor asks and the evidence they expect. Use it to prepare for your internal audit or as a final check before the certification audit. The requirements of the standard explain each point in substance.
NEN 7510:2024 is the current version. Does your organisation still work with an older version? Then the same clauses apply, but check whether your documentation matches the revised list of measures.
How do you use this checklist?
Go through the table for each clause. Mark each point as ready, partly ready or still to do. Points you mark as “partly ready” or “still to do” are the gaps you must address before the audit.
A tip: do not go through the checklist only at your desk. Walk through the practice too. Does a random employee know what to do with a phishing email? Are the server rooms really locked? The auditor checks exactly that.
Clause 4: context of the organisation
This clause is about understanding the environment in which you operate. Without that context, you cannot build a good security system.
| Requirement | Evidence you need | Ready? |
|---|---|---|
| Internal and external factors documented | Context analysis or SWOT-style overview | ☐ |
| Interested parties and their requirements determined | List of stakeholders (Health and Youth Care Inspectorate (IGJ, Inspectie Gezondheidszorg en Jeugd), patients, insurers) with their requirements | ☐ |
| Scope of the ISMS determined and documented | Scope document, approved by management | ☐ |
| Boundaries of the scope logical and not artificially drawn | Auditor can follow the reasoning | ☐ |
Clause 5: leadership
Management commitment is a core requirement. The auditor looks for evidence of real involvement, not a signature on a document.
| Requirement | Evidence you need | Ready? |
|---|---|---|
| Information security policy approved by management | Policy document, signed and dated | ☐ |
| Policy communicated to staff | Training records, intranet, minutes | ☐ |
| Roles and responsibilities assigned | Job descriptions or organisation chart | ☐ |
| Management demonstrably involved in ISMS decisions | Management review minutes | ☐ |
Clause 6: planning
Planning is about addressing risks before they cause harm.
| Requirement | Evidence you need | Ready? |
|---|---|---|
| Risk analysis carried out using a documented method | Risk register with likelihood, impact and owners | ☐ |
| Healthcare-specific risks included (patient data, medical equipment) | Risks specific to your care practice in the register | ☐ |
| Risk treatment determined for each risk | Risk treatment plan | ☐ |
| Statement of Applicability (VvT, Verklaring van Toepasselijkheid) drawn up | VvT with justification for each measure | ☐ |
| Information security objectives set | Measurable objectives per department or level | ☐ |
The VvT is one of the first documents the auditor asks for. Make sure each measure in NEN 7510-2 shows whether you selected it and why. Missing justification is a common finding.
Clause 7: support
Do you have the resources and people to keep the system running?
| Requirement | Evidence you need | Ready? |
|---|---|---|
| Necessary resources available (people, budget, tools) | Project plan or budget | ☐ |
| Staff competences determined and secured | Job profiles, diplomas, certificates | ☐ |
| Awareness training carried out for all staff | Training record with date and attendees | ☐ |
| Communication plan for information security | Plan or calendar of communication moments | ☐ |
| Mandatory documents present and up to date | See the mandatory documents for the full overview | ☐ |
Clause 8: operation
Do you do in practice what you have planned?
| Requirement | Evidence you need | Ready? |
|---|---|---|
| Risk analysis carried out and documented | Version with date and approval | ☐ |
| Controls actually implemented | Technical configurations, procedure descriptions | ☐ |
| Supplier agreements on information security made | Processor agreements (verwerkersovereenkomsten), contracts | ☐ |
| Logging of access to patient data active (NEN 7513) | Log report or system configuration of the EPD/ECD | ☐ |
| Medical equipment included in scope | Equipment inventory in the risk analysis | ☐ |
Clause 9: evaluation
Do you check whether the system works?
| Requirement | Evidence you need | Ready? |
|---|---|---|
| KPIs or indicators defined and measured | Measurement results over at least one quarter | ☐ |
| Internal audit carried out | Internal audit report with findings | ☐ |
| Internal auditor independent of the processes audited | Audit schedule with assignment and reasoning | ☐ |
| Management review held | Minutes with agenda, input and decisions | ☐ |
| Management review led to concrete actions | Action list from the management review | ☐ |
Clause 10: improvement
Does the system improve based on what you learn?
| Requirement | Evidence you need | Ready? |
|---|---|---|
| Nonconformities recorded and analysed | Nonconformity register or incident log | ☐ |
| Corrective measures taken and followed up | Action list with status and closure | ☐ |
| Continuous improvement actions demonstrable | Improvements in policy, procedures or measures | ☐ |
Healthcare-specific points
NEN 7510 includes additions that are specific to healthcare. These are the points the auditor looks at especially closely.
| Healthcare-specific point | What you must demonstrate | Ready? |
|---|---|---|
| Logging compliant with NEN 7513 | Automatic logging: who, when, which patient, which action | ☐ |
| Access based on the treatment relationship arranged | Access management linked to active treatment relationships | ☐ |
| Patients can request log data | Procedure or portal function available | ☐ |
| Security of networked medical equipment | Inventory and risk treatment | ☐ |
| Data exchange in the chain secured | Agreements in line with NEN 7512 | ☐ |
| Processors (EPD supplier, hosting provider) have signed agreements | Processor agreements on file | ☐ |
What do you do with the outcome?
All boxes ticked? Then you are well prepared for the certification audit. But honestly, that is rarely the reality on a first run-through.
Set priorities based on your gaps. Large missing pieces (no risk analysis, no management review) are major nonconformities: they block the certificate. Small gaps (one document out of date) are minor nonconformities: annoying, but manageable.
Read more about the mandatory documents you need for certification, or look at the step-by-step plan if you are still in the implementation phase.
Sources
- NEN 7510 at NEN : the official standard
- IGJ on NEN 7510 : questions and answers from the inspectorate