Frequently asked questions about NEN 7510

The most common questions about NEN 7510 certification, with practical answers. The standard is available free of charge via NEN Connect , and the IGJ (Dutch Health and Youth Care Inspectorate) supervises compliance in healthcare.

General

What is NEN 7510?

NEN 7510 is the Dutch standard for information security in the healthcare sector. The standard describes how healthcare organisations must protect patient data and health information. It is based on ISO 27001, with additions specific to healthcare.

Is NEN 7510 mandatory?

Certification is not formally required by law. However, the content of the standard does count as the benchmark for information security in healthcare.

The Wet aanvullende bepalingen verwerking persoonsgegevens in de zorg (Dutch Supplementary Provisions for Processing Personal Data in Healthcare Act) refers to NEN 7510. Healthcare providers must take “appropriate technical and organisational measures”. NEN 7510 describes what “appropriate” means.

In practice, NEN 7510 is often required through contracts with health insurers, partnerships and large healthcare institutions that demand it from their suppliers.

Who is NEN 7510 intended for?

The standard is intended for all organisations that work with patient data or health information. This includes healthcare providers such as hospitals, GP practices, pharmacies, mental health institutions and nursing homes. It also includes suppliers to healthcare: electronic patient record (EPD) suppliers, IT administrators, software developers and hosting providers.

What is the difference between NEN 7510-1 and NEN 7510-2?

NEN 7510-1 describes the management system: how you organise information security. This is the part you are certified against.

NEN 7510-2 contains the control measures: concrete measures you can implement. You select from these based on your risk analysis.

What are NEN 7512 and NEN 7513?

NEN 7512 covers the basis of trust for exchanging data: how do you make sure you are communicating with the right party?

NEN 7513 specifies the requirements for logging access to patient data: who viewed which data, and when?

These standards supplement NEN 7510 and are often included in the certification process.

Costs and time

How much does NEN 7510 certification cost?

Costs vary considerably. For a small healthcare organisation (up to 25 FTE, full-time equivalents), expect €8,000 to €25,000 in the first year. For medium-sized organisations (25 to 100 FTE), this is €25,000 to €90,000. Large healthcare organisations (100+ FTE) can spend €90,000 to several hundred thousand euros.

This includes implementation costs, any external support, technical measures and the certification audit. See costs and timeline for a detailed breakdown.

How long does it take to get NEN 7510 certified?

For a small organisation with a good starting position, 3 to 6 months is achievable. Medium-sized organisations expect 6 to 9 months. Large, complex healthcare organisations need 9 to 18 months.

The timeline depends on your current situation, available capacity and how quickly decisions are made.

How long is the certificate valid?

The certificate is valid for three years. Each year a surveillance audit takes place, in which the certification body checks whether you still comply. After three years, a recertification audit follows.

Can I get a subsidy for NEN 7510?

There are no specific subsidies for NEN 7510 certification. General schemes for digitalisation or information security in healthcare may apply, however. Check with your industry organisation or regional partnerships.

The standard

Is NEN 7510 the same as ISO 27001?

No, but they are closely related. NEN 7510 is based on ISO 27001, and they overlap by about 80%. NEN 7510 adds healthcare-specific requirements: logging access to patient data, protecting medical equipment, and access based on the treatment relationship.

If you already have ISO 27001, the step to NEN 7510 is relatively small. The reverse also applies: NEN 7510 gives you a good basis for ISO 27001.

Can I combine NEN 7510 and ISO 27001?

Yes, and this is often efficient. The systems largely overlap. You can meet both standards with one integrated system and combine the audits. This saves time and money.

Read more on the NEN 7510 vs ISO 27001 page.

Do I have to implement all the control measures from NEN 7510-2?

No. You select the measures that fit your risks. However, you must be able to explain why you did or did not choose certain measures. You record this in the Statement of Applicability (VvT, Verklaring van Toepasselijkheid).

What is the Statement of Applicability?

The Statement of Applicability (VvT, Verklaring van Toepasselijkheid) is a document in which you record, for each control measure in NEN 7510-2, whether you have selected it and why. If you do not select a measure, you explain why not (for example: not applicable, risk accepted).

The VvT is a mandatory document for certification.

What has changed in NEN 7510:2024?

The revised NEN 7510:2024 was published in December 2024. The main changes are alignment with the latest versions of ISO 27001:2022 and ISO 27002:2022, and a clear mapping to the NIS2 Directive.

Organisations with a certificate against the old version must move to the new version before 20 February 2027.

The audit

How does the certification audit work?

The initial certification audit has two stages. In stage 1, the auditor reviews your documentation: policy, risk analysis and procedures. In stage 2, the auditor visits your location and checks whether you do in practice what you have documented. This happens through interviews, observations and sampling.

What happens if the auditor finds nonconformities?

For minor nonconformities, you can still receive the certificate, but you must correct them within an agreed period (typically 90 days). For major nonconformities, you do not receive the certificate until the nonconformity has been resolved.

Who is allowed to certify NEN 7510?

Only certification bodies accredited by the Dutch Accreditation Council (RvA, Raad voor Accreditatie) for NEN 7510. This guarantees that the audit meets the requirements. Accredited bodies include Kiwa, DNV, TÜV, DEKRA and LRQA.

Can the audit take place remotely?

Stage 1 (documentation review) can often take place remotely. Stage 2 (implementation audit) largely takes place on site. The auditor needs to see the real situation: server rooms, workstations, and conversations with employees.

For organisations with several locations, the auditor visits a selection.

Practice

Can I implement NEN 7510 myself?

Yes, if you have the expertise in-house. You need the standard (free to download via NEN Connect ) and time to build the system.

Many organisations choose external support, especially where information security is not their core competence. An adviser helps with interpretation, avoids pitfalls and speeds up the process.

We already have ISO 27001. Is the step to NEN 7510 large?

No, it is relatively small. You already have the management system. You add the healthcare-specific elements: logging in line with NEN 7513, access based on the treatment relationship, specific attention to medical equipment and patient rights.

Expect 20 to 30% extra effort on top of your ISO 27001 implementation.

We are a small GP practice. Is NEN 7510 not overkill?

NEN 7510 is scalable. You adjust the depth to your situation. A GP practice does not need to set up ISO-style bureaucracy. You do need the core in place: risk analysis, policy, access management, training and logging.

There are simplified routes and tools for small healthcare organisations. The effort is manageable.

Do self-employed healthcare professionals also have to comply with NEN 7510?

If you process patient data as a self-employed professional (zzp’er), you must meet the information security requirements. Formal certification is often not practical or proportionate for a one-person practice.

Clients may still require you to demonstrate that you follow the principles of NEN 7510. You can do this with your own declaration and evidence of measures.

NEN 7510 helps you meet the security requirements of the General Data Protection Regulation (AVG, Algemene verordening gegevensbescherming, Dutch GDPR), article 32: appropriate technical and organisational measures. However, NEN 7510 does not cover all GDPR obligations.

You also need policy on the lawfulness of processing, transparency, retention periods, data subject rights and data breach procedures. NEN 7510 is one part of the puzzle, not the complete solution.

What is Z-CERT?

Z-CERT is the Computer Emergency Response Team for the Dutch healthcare sector. It offers support with cybersecurity incidents, shares threat information and helps with prevention.

Joining Z-CERT is not mandatory, but it is recommended for healthcare organisations.

What if a data breach happens?

You must report a data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if it poses risks to the people concerned. With a data breach involving patient data, this is almost always the case.

Your NEN 7510 system must include an incident procedure that describes how you handle security incidents, including data breaches. This covers detection, response, reporting and analysis.

Supervision

Does the IGJ check NEN 7510?

The Dutch Health and Youth Care Inspectorate (IGJ, Inspectie Gezondheidszorg en Jeugd) supervises healthcare providers, including information security. Since incidents involving ICT security in healthcare, attention to this has increased.

The IGJ can check whether you have taken sufficient measures. A NEN 7510 certificate is strong evidence that your information security is in order.

What happens if I do not comply with NEN 7510?

If something goes wrong (a data breach, ransomware, an outage) and it turns out you had insufficient security measures, there can be consequences. The Dutch Data Protection Authority can impose fines. The IGJ can take measures. Contract partners can end the relationship.

Without an incident, there is no direct enforcement of NEN 7510. But you do run the risk.

Next step

Still have questions? The step-by-step plan explains how to get started. Or see the requirements of the standard for more detail on the content.