NEN 7510 project lead: who leads the project?
A NEN 7510 project needs one project lead who keeps the overview, monitors the schedule and brings the right people together. That person does not have to be an information security specialist. They must know the organisation well and have the authority to get decisions carried through. The step-by-step plan shows what the project lead needs to do in each phase. For how much time it takes, see costs and timeline. If you are unsure whether to fill the role in-house or hire a consultant, read implement yourself or with a consultant.
The project lead is not automatically the person who sets the content of the standard. These are different roles. In a small practice, the same person often fills both.
Which tasks should the project lead do?
- Draw up the project plan, with milestones and a realistic estimate of the duration.
- Propose the scope and have it approved by management or the board.
- Put together the working group and record agreements on time and budget.
- Monitor progress on the measures, with a weekly or fortnightly meeting.
- Keep track of deviations from the gap analysis (a comparison of your current situation with the requirements of the standard) and the internal audit, and make sure they are resolved.
- Maintain contact with the certification body, including planning the audit.
Which tasks should the project lead not do alone?
A project lead who writes everything themselves becomes a bottleneck. The content decisions belong to the owners of the measures. For example: the practice manager of a GP practice is the project lead. The GP assesses which risks the care process carries, the systems administrator describes the backup, and management chooses the measures. The project lead schedules those conversations and makes sure the outcomes are written down, but does not take over ownership.
Which profiles work well?
| Profile | Strong in | Watch out for |
|---|---|---|
| Practice manager or business manager | Overview, decision-making, budget | Often has little time for detail |
| Quality officer | Process thinking, documentation, audits | May underestimate the IT side |
| IT manager or functional administrator | Systems, technical measures | Can become too technical for the care side |
| External consultant | Experience with audits | Costs money, and the knowledge does not automatically stay in the organisation after the project |
In a small practice, the combination of a practice manager and an external support person is often the most practical option. In a larger organisation, an internal project lead with a consultant on call is often cheaper in the long run. See also NEN 7510 for small practices.
How much time does it take?
The time needed depends on the scope and the starting situation. As a practical indication: in a small practice, that is a few hours a week during the build-up phase, for example six hours a week for six months. In a hospital, the role is full-time or almost full-time. The costs and timeline give an indication by organisation size: 100 to 200 internal hours for a small practice, and more than 1,000 hours for a large organisation. It is sensible to free up this time in advance, rather than give the role as an extra task on top of the existing workload.
A project lead who drops out halfway is one of the most common causes of delay. So record who takes over the role and how the handover will work.
Step by step: appointing a project lead
Record the assignment
Write a short note on what the project lead must deliver, with which powers and within which timeframe. Have management sign it.
Choose the person for overview and authority
The best candidate can hold a conversation with management and with a clinician or systems administrator without their own work coming to a standstill.
Plan the time
Put the hours in the diary and appoint a replacement for absences.
Form the working group
Include one representative per domain: care, IT, procurement and the data protection officer (FG) if there is one.
Monitor progress
Set fixed meetings and keep an updated action plan. This is also the evidence the auditor will want to see later.
Common mistakes
- Placing the role with the IT department without care knowledge. The measures affect the care process, and the project lead must be able to translate between the two.
- No mandate. A project lead who cannot make decisions waits for everyone and gets stuck.
- No handover. If the person leaves, all the knowledge goes with them.
- Starting too late. The role is only filled once the audit is already scheduled. By then there is no time left to resolve deviations.
How this fits into the project
The step-by-step plan describes the phases Preparing, Implementing and Certifying. The project lead keeps the phases connected. For the role of the DPO (FG) and the GDPR side, see GDPR and NEN 7510.
Additional notes
- The hour figures are practical estimates, not requirements of the standard. The standard does not prescribe a number of hours.
- Whether a separate information security function is mandatory depends on the organisation and the scope. Discuss this with your certification body before you record the division of roles.
- The table of profiles and the division of tasks are based on practical experience, not a requirement of the standard.