Measures NEN 7510: technical and organisational measures

What are the measures of NEN 7510, and what is the difference between technical and organisational measures? Technical measures are things you set up in systems, such as encryption and access management. Organisational measures are agreements, policies and behaviour, such as an incident procedure or an awareness training. You need both. The measures are set out in NEN 7510-2, published by NEN and built on ISO 27002.

What is the difference between technical and organisational?

The distinction is simple when you look at practice. A technical measure works through equipment or software. An organisational measure works through people, agreements and processes.

Encrypting a laptop is technical: you switch it on in the system. A clean desk policy is organisational: you agree that nobody leaves patient records on the desk. They often reinforce each other. Access management (technical) only makes sense if you also agree who is authorised for what (organisational).

NEN 7510-2:2024 divides all measures into four categories: organisational, people, physical and technological. This classification comes directly from ISO 27002:2022.

The four categories of measures in NEN 7510-2

Since NEN 7510-2:2024, the measures are no longer divided across fourteen chapters but across four categories. This aligns with ISO 27002:2022. Two categories are mainly organisational in nature, one is physical and one is technological. Below you can see the type of each category and an example from healthcare.

Category	Type	Example in healthcare practice
Organisational	Organisational	Policy and incident procedure for the EHR
People	Organisational	Awareness training on phishing for front desk staff
Physical	Partly technical, partly organisational	Server room with access pass and clean desk policy
Technological	Technical	Encryption of patient data and logging of record access

Examples of technical measures under NEN 7510

Technical measures mainly fall under the technological category in NEN 7510-2. You set them up, they work automatically, and an employee cannot easily bypass them. For healthcare, these are the most important.

Measure	Type	Example in healthcare practice
Access management	Technical	Only the treating clinician sees the record, based on the treatment relationship
Encryption	Technical	Patient data encrypted on laptops and in back-ups
Logging	Technical	Recording who opened a record and when, see NEN 7513
Malware protection	Technical	Virus scanner and email filter on all workstations
Network segmentation	Technical	Medical equipment separated from the office network
Back-up and recovery	Technical	Daily back-up of the EHR, tested periodically

Logging deserves extra attention in healthcare. It is a technical measure that NEN 7513 elaborates on: who looked at which record, and when?

Examples of organisational measures under NEN 7510

Organisational measures fall under the organisational and people categories. They concern agreements, policies and behaviour. Without these measures, technical measures often fail, because people bypass them or do not know about them.

Measure	Type	Example in healthcare practice
Information security policy	Organisational	Adopted policy signed by the board
Incident procedure	Organisational	Steps to follow in case of a data breach or ransomware
Supplier management	Organisational	Assessing the EHR supplier on information security
Segregation of duties	Organisational	The person who authorises access may not also manage the logs
Awareness training	People	Staff learn to recognise phishing
Confidentiality agreement	People	New staff sign a confidentiality statement

The link with the risk analysis and the Statement of Applicability

You do not choose all measures, but the measures that suit your risks. You determine this in the risk analysis. A GP practice chooses different measures than a hospital with networked medical equipment.

You record which measures you do and do not select in the Statement of Applicability (Verklaring van Toepasselijkheid, SoA). For each measure in NEN 7510-2, you note whether you apply it and why. The auditor checks whether those choices are logical given your risks. Read more about all the requirements of NEN 7510 or review the step-by-step plan.

The inventory of information and assets belongs with these measures. See the asset register for the set-up.

Working on it in practice

Record the choice and justification for each measure in the Statement of Applicability for NEN 7510. The example rows show how you link risk, implementation and evidence together.