NEN 7510 mandatory documents

NEN 7510 explicitly requires a number of documents. Without those documents, certification is not possible. This page shows, per chapter, which documents the standard requires, plus the healthcare-specific additions that are essential in practice. The requirements of the standard explain each chapter in substance. Use the NEN 7510 checklist to check whether your documentation is complete.

NEN 7510 deliberately does not prescribe specific formats. It is about the content and the evidence, not the form. Two pages with the right information are better than a thick handbook that nobody reads.

Mandatory documents per standard chapter

The table below shows the documents that NEN 7510-1 explicitly requires. “Documented information” is the term the standard uses. It means recorded and available, in whatever format.

Chapter	Document	Purpose
4	Scope of the ISMS (information security management system)	Defines which parts of your organisation fall under the system
5	Information security policy	Intentions and direction of the management, including commitment to protecting patient data
6	Risk assessment methodology	Describes how you identify and assess risks
6	Results of the risk assessment	The risk register with likelihoods, impacts and owners
6	Risk treatment plan	For each risk: what you do about it (avoid, reduce, transfer, accept)
6	Statement of Applicability (VvT, Verklaring van Toepasselijkheid)	For each measure in NEN 7510-2: selected or not, with justification
6	Information security objectives	Measurable objectives for each relevant function or department
7	Evidence of competence	Training, certificates and experience of employees in relevant roles
9	Results of monitoring and measurement	Measurements that show whether the system works
9	Internal audit programme and reports	Planned audits and their outcomes
9	Results of the management review	Minutes with input, discussion and decisions
10	Nonconformities and corrective actions	Register of problems, causes and actions taken

Healthcare-specific documents

On top of the generic NEN 7510 documents, the healthcare sector has additional documents that the auditor expects. They are not always prescribed word for word in the standard, but they follow from the healthcare-specific requirements.

Document	Why it is needed	What it relates to
Authorisation matrix	Records who has access to which systems and data, based on function and treatment relationship	Access management (NEN 7510-2, measure 8.2)
Logging policy	Describes how logging is set up, who manages the logs and how long they are kept	NEN 7513 logging
Data processing agreements	Agreements with EPD suppliers, hosting providers and other processors on information security	AVG (Dutch GDPR), article 28, and NEN 7510-2 chapter 5
Incident register	Overview of security incidents and data breaches, with how they were handled	Incident management and the GDPR breach notification duty
Backup and recovery procedure	Describes the backup policy and recovery procedure, including test results	Availability of patient systems
Clean desk policy	Agreements on protecting physical and on-screen information	Physical security
Password policy	Requirements for passwords, account management and privileges	Access management
Awareness training records	Evidence that all employees have been trained in information security	Awareness (NEN 7510-1 chapter 7)

The Statement of Applicability in detail

The Statement of Applicability (VvT, Verklaring van Toepasselijkheid) is the most critical document for certification. The auditor always starts with it. It is the document that justifies your choices.

NEN 7510-2 contains an extensive list of control measures, divided into four categories: organisational, people, physical and technological. For each measure, you document in the VvT:

Does the measure apply to your organisation?
Have you implemented it?
Why, or why not?

If you have not selected a measure, you must be able to explain why. “Not relevant to our scope” is a valid reason, provided it is justified. “Not got round to it yet” is not.

A VvT that does not match your risk analysis is a common mistake. If your risk analysis shows that ransomware is a major risk, but you have not selected a backup measure in the VvT, the auditor will question your logic.

The authorisation matrix: care-specific and complex

The authorisation matrix is a document you will find in many sectors, but in healthcare it is particularly complex. Access management in healthcare is not only about functions, but also about treatment relationships.

A nurse on the cardiology ward has access to the records of her patients on that ward. Not to all patient records in the hospital. Not to the records of patients she treated earlier but whose treatment relationship has since ended.

Your authorisation matrix must support this. It describes:

Which roles or functions exist
Which systems and datasets each role can access
At which level (read, change, export)
How access is requested, approved and withdrawn
How treatment relationships are determined and recorded

In small practices this can be simpler than in hospitals. But a GP practice also needs an authorisation matrix: who has access to the GP information system (HIS), who does not, and what may each person do in it?

How much documentation is enough?

This is the question that keeps certification projects busy. The answer: enough to show that you know what you are doing and that you do it.

The standard does not prescribe a specific format, a minimum number of pages or a maximum level of complexity. What it asks for is workable, up-to-date documentation that matches your practice.

Pitfall 1: too little documentation. If the auditor asks how you manage access and you cannot show it, that is a nonconformity.

Pitfall 2: too much documentation. Twenty pages of policy that nobody knows and that has not been updated for years will not convince the auditor. They will then ask: “Do you really work this way?” If the answer is “no”, that is a nonconformity.

Managing documentation

Mandatory documents must be managed. That means: they carry a version number and date, are approved by the right person, are available to those who need them, and are protected against unintended changes.

In practice, most organisations manage this with a simple document register: a list of all relevant documents, their version number, the date of the last review, the owner and the location.