NEN 7510, NIS2 and the Cyber Security Act

New legislation is on its way. The European NIS2 Directive is being turned into Dutch law, the Cyberbeveiligingswet (Dutch Cyber Security Act). The NCSC (Dutch National Cyber Security Centre) provides up-to-date information. For healthcare organisations already working on NEN 7510 , this feels like one more item on the list. But the overlap is large, and NEN 7510:2024 has been specifically adapted for it.

What is NIS2?

NIS2 is a European directive on cybersecurity. The name stands for Network and Information Security Directive, version 2. It succeeds the first NIS Directive from 2016.

The directive sets requirements for the cybersecurity of organisations that are essential to society. Healthcare is one of those essential sectors. Hospitals, laboratories and manufacturers of medical devices all fall under NIS2.

The directive requires these organisations to take cybersecurity measures, report incidents and account for their actions. The aim is to strengthen Europe’s digital resilience.

The Cyber Security Act

European directives must be turned into national law. In the Netherlands, this happens through the Cyberbeveiligingswet (Cbw, Dutch Cyber Security Act). The Act is still in preparation and is expected to take effect in 2025 or 2026.

The Cyber Security Act translates the NIS2 requirements into the Dutch context. For healthcare, this means the obligations become concrete: which organisations are covered, which measures are required, and how the reporting obligation works.

The timing is still uncertain. The bill was sent to the Raad van State (Council of State) at the end of 2024. It is expected to pass the Tweede Kamer (House of Representatives) in 2025 and to take effect at the end of 2025 or the beginning of 2026.

Who is covered in healthcare?

NIS2 distinguishes between “essential” and “important” entities. For healthcare, these include healthcare providers that deliver critical services (think hospitals and acute care), EU reference laboratories and manufacturers of critical medical devices.

Smaller healthcare organisations can also fall under the Act if they form part of a larger institution’s supply chain. The exact scope will be set out in the Cyber Security Act.

Most GP practices and small healthcare institutions do not fall directly under NIS2. However, their suppliers and partners may do, which has indirect consequences for them.

Is NEN 7510 the same as NIS2?

No. NEN 7510 is a standard you can certify against. NIS2 is legislation. You do not obtain a “NIS2 certificate”. However, NEN 7510 covers a large part of the NIS2 requirements, so the two reinforce each other.

The main difference: NEN 7510 is voluntary (although it is often required), while the Cyber Security Act makes NIS2 legally mandatory for designated organisations. NIS2 also adds requirements that NEN 7510 does not explicitly contain, such as the strict reporting obligation and personal liability for management.

Aspect	NEN 7510	NIS2 / Cyber Security Act
Type	Standard, certifiable	Legislation, mandatory
Scope	Information security in healthcare	Cybersecurity in essential sectors
Mandatory?	Often through contracts and supervision	Legally required for designated organisations
Incident reporting	General (GDPR for data breaches)	Strict: initial report within 24 hours
Management liability	Not explicit	Board members can be held personally accountable
Sanctions	Loss of certificate, supervision	Fines linked to turnover
Supplier oversight	Limited	Explicitly required

In short: if you achieve NEN 7510, you have largely laid the foundation for NIS2. But you are not fully there yet. Below you can read where the two overlap and where they differ.

NEN 7510 and NIS2: what is the overlap?

The good news: if NEN 7510 is in order, you are already a long way towards NIS2 compliance.

The revised NEN 7510:2024 contains an explicit mapping to NIS2. For each part of the directive, you can see which NEN 7510 measures contribute to it. This mapping is included in the standard to make things easier for healthcare organisations.

The overlap is substantial. Both cover managing cybersecurity risks, implementing measures, monitoring and improving, and handling incidents.

There are also differences. NIS2 adds things that are not, or are less explicitly, in NEN 7510.

What does NIS2 add to NEN 7510?

Incident reporting obligation. Under NIS2, you must report significant incidents to the supervisory authority. This goes further than the existing reporting obligation for data breaches under the GDPR. Incidents that are not data breaches but do disrupt service must also be reported. The deadlines are strict: an initial report within 24 hours.

Supply chain oversight. NIS2 explicitly requires you to manage the cybersecurity of your suppliers. You cannot look at your own security separately from the parties you depend on. This calls for supplier assessments, contractual agreements and monitoring.

Management responsibility. The board is explicitly responsible for cybersecurity. Board members can be held personally accountable if the organisation does not meet its obligations. This increases the pressure to take cybersecurity seriously.

Sanctions. NIS2 introduces serious fines for organisations that do not comply. The maximum fines are linked to turnover, similar to the GDPR.

What does NIS2 mean in practice for NEN 7510 organisations?

If you are a healthcare organisation that will fall under NIS2, this is how to approach it.

Make sure NEN 7510 is in order. This is the foundation. The standard covers most of the NIS2 requirements. If you are not yet NEN 7510 compliant, start there.

Move to NEN 7510:2024. The new version is aligned with NIS2. If you are still on an older version, plan the transition. Certified organisations have until February 2027, but start sooner.

Look at what NEN 7510 does not cover. The reporting obligation and the supply chain requirements are the most important additions. Set up a process for reporting incidents. Assess your critical suppliers for cybersecurity.

Involve the board. Management responsibility requires the involvement of the top. Make sure the board understands what the obligations are and what is at stake.

The timeline

Things will become more concrete in the coming years. This is the expected timeline.

2024: NEN 7510:2024 published with the NIS2 mapping.

2025: Cyber Security Act passes the Tweede Kamer (expected).

2025-2026: Cyber Security Act takes effect.

2027: Transition period for NEN 7510:2024 ends.

The exact dates depend on the political process. But the direction is clear: more obligations, stricter supervision, higher sanctions.

Do not wait with NEN 7510 and NIS2 preparation

It is tempting to wait until the legislation is final. But that is not sensible.

The core of the obligations is already clear. NIS2 has been published, and the Cyber Security Act follows the directive. You know what is coming.

Implementing NEN 7510 takes time. If you start now, you will be ready when the Act takes effect. If you wait, you will have to rush and run the risk of not being ready.

Suppliers and partners will also start setting requirements. Large healthcare institutions that fall under NIS2 must secure their supply chain. That means they will set requirements for you too. Certification will become a condition for working together.

Z-CERT and support

You do not have to do this alone. Z-CERT is the Computer Emergency Response Team for the healthcare sector. It provides support during incidents, shares threat information and helps with prevention.

Joining Z-CERT is currently voluntary. Under the Cyber Security Act, this may become mandatory for certain organisations. But even without an obligation, it is sensible. You gain access to expertise and warnings that you would not have on your own.

The role of NEN 7510

NEN 7510 is not a competitor to NIS2. It is a tool for meeting it.

The supervisory authority will check whether you have taken the required measures. NEN 7510 certification is a strong way to demonstrate this. It shows that you have approached information security systematically and that an independent party has assessed it.

However, meeting NEN 7510 alone is not enough for full NIS2 compliance. You also need reporting processes, supplier requirements and management involvement. Treat NEN 7510 as the core, and build the additional NIS2 obligations around it.