Requirements of NEN 7510
What exactly does NEN 7510 ask? The standard is available free of charge via NEN Connect . NEN 7510 consists of two parts: NEN 7510-1, with the management requirements, and NEN 7510-2, with the controls.
The requirements of NEN 7510 in brief
NEN 7510-1 contains the requirements against which you are audited, divided over clauses 4 to 10. Below, you can see what the standard asks for each clause. Further down this page, we work out each clause.
| Clause | Topic | What it asks |
|---|---|---|
| 4 | Context | Internal and external factors, interested parties, determining scope |
| 5 | Leadership | Involving management, setting policy, assigning roles |
| 6 | Planning | Risks, risk analysis, objectives |
| 7 | Support | People, competences, awareness, documentation |
| 8 | Operation | Carrying out plans, implementing risk treatment |
| 9 | Evaluation | Measuring, internal audit, management review |
| 10 | Improvement | Correcting nonconformities, continuous improvement |
NEN 7510-2 adds the controls: concrete measures you choose based on your risks. Since the 2024 version, they are grouped into four categories, in line with ISO 27002.
| Category | Type | Example |
|---|---|---|
| Organisational | Organisational | Policy, supplier management, incident procedure |
| People | Organisational | Screening, awareness training, confidentiality |
| Physical | Partly technical | Access security for server room, clean desk |
| Technological | Technical | Access management, encryption, logging, backups |
We explain the difference between technical and organisational measures separately, with examples per category, on the page technical and organisational measures.
Structure of NEN 7510
NEN 7510 is based on ISO 27001 and follows the same structure. Clauses 4 to 10 contain the requirements against which you are audited. Clauses 1 to 3 are introductory.
NEN 7510-1 describes the management system: how you organise information security. This is comparable to ISO 27001.
NEN 7510-2 contains the controls: concrete measures you can implement. This is comparable to ISO 27002, but with healthcare-specific additions.
NEN 7510:2024 is the current version. It is aligned with ISO 27001:2022 and ISO 27002:2022. Organisations with a certificate on the old version must switch before February 2027.
The requirements of NEN 7510-1 per clause
Clause 4: context of the organisation
You must understand the context of your organisation before you can set up an effective security system. This clause asks for four things.
Identify internal and external factors that are relevant to information security. External factors include, for example, laws and regulations, technological developments and threats. Internal factors include your culture, structure and capabilities.
Determine interested parties and their requirements. Who has an interest in your information security? Patients, staff, supervisors, partners in care, insurers. What do they expect?
Determine the scope. Which parts of your organisation fall within the security system? You must document this.
Establish, implement, maintain and continually improve the information security management system.
Clause 5: leadership
Management must be actively involved in information security. This is not a formality but a core requirement.
Management commitment must be evident in concrete actions: allocating resources, setting policy, integrating security into business processes, and communicating its importance.
The information security policy must be approved by management. This policy describes the intentions and direction of the organisation. It must include commitment to protecting patient data, to meeting requirements, and to continual improvement.
Roles and responsibilities must be clearly assigned. Who is responsible for what? This must be communicated within the organisation.
Clause 6: planning
Planning is about addressing risks and setting objectives.
Identify risks and opportunities. What could go wrong? What are the opportunities for improvement? This is broader than the risk analysis for controls alone.
The risk analysis is a core element. You identify risks to the availability, integrity and confidentiality of health information. You assess the likelihood and impact. You decide which risks you accept and which you treat.
Risk treatment means deciding, for each risk, what you do: avoid, reduce, transfer or accept it. For the risks you reduce, you select controls from NEN 7510-2.
Objectives are set for relevant functions and levels. Objectives must be measurable where possible and consistent with the policy.
The risk analysis is healthcare-specific. Patient data is particularly sensitive. A data breach involving medical information has a greater impact than one involving general personal data. Take this into account.
Clause 7: support
This clause is about the resources you need to make the system work.
Resources must be available: people, time, money and tools.
Competences of staff must match their tasks. You determine which competences are needed, make sure staff have them, and keep evidence.
Awareness among staff about the policy and their role is essential. Everyone must know what is expected of them.
Communication must be planned: what do you communicate, when, to whom, and by whom?
Documented information must be created and managed. The standard specifies the minimum documents required. Beyond that, you decide which additional documentation you need.
Clause 8: operation
This is about carrying out your plans in practice.
Operational planning and control means planning and managing your processes so that they meet the requirements. You implement the planned actions.
The risk analysis must be carried out according to plan, and the results kept.
Risk treatment must be implemented: the chosen controls must actually be put in place.
Clause 9: performance evaluation
You must check whether the system works as intended.
Monitoring and measurement of the system’s performance. You determine what you measure, how, when and by whom.
Internal audits must be carried out at planned intervals. The audit checks whether you meet the requirements of the standard and your own requirements, and whether the system is effectively implemented.
Management review is a periodic assessment by management of how the system is performing. The standard specifies what input the review must have and which decisions must come out of it.
Clause 10: improvement
The system must continually get better.
Nonconformities and corrective actions: if something goes wrong, you must take action. You correct the problem, investigate the cause and take measures to prevent recurrence.
Continual improvement is an ongoing process. You improve the suitability, adequacy and effectiveness of the system.
The controls (NEN 7510-2)
NEN 7510-2 contains the controls you can implement to manage risks. The controls are organised into categories. We explain the difference between technical and organisational measures separately, with examples from healthcare.
The four categories in brief:
| Category | What it covers |
|---|---|
| Organisational | Policy, roles, classification, supplier management, incident management |
| People | Screening, employment conditions, awareness and training |
| Physical | Secure zones, physical access management, protection of equipment |
| Technological | Access management, cryptography, logging, backups, network security |
On the page technical and organisational measures, you find an example table per category with concrete measures from healthcare practice.
Healthcare-specific additions to NEN 7510
NEN 7510 adds specific requirements for the healthcare sector on top of the ISO 27001 basis.
Logging of access to patient data
NEN 7513 sets out the logging requirements in healthcare. You must record who viewed or changed which patient data, and when. This is essential for accountability and investigation.
Logging must include, at a minimum: who (which employee), when (date and time), what (which action), and which patient (BSN, Burgerservicenummer, citizen service number, or another identifier). Read the detailed explanation of logging for more information.
Access based on the treatment relationship
In healthcare, the principle applies that only staff with a treatment relationship may access patient data. Access management must support this.
This is more complex than standard role-based access control. Treatment relationships change, patients are transferred, and staff work in changing teams.
Patient rights
Patients have rights under the GDPR and specific healthcare legislation. They may view their record, know who has viewed their data, and in certain cases have data corrected or deleted.
Your system must support these rights. It must be technically possible to give access and to provide logs of access.
Medical equipment
Medical equipment also falls under information security if it processes data or gives access to systems. Think of infusion pumps with a network connection, monitors that send patient data, and diagnostic equipment.
Securing medical equipment needs specific attention: patches are not always available, equipment cannot simply be taken offline, and suppliers often have access.
Data exchange in the care chain
Care works in chains: GP, specialist, pharmacy, laboratory. Data exchange is necessary for good care but introduces risks.
NEN 7512 specifically covers the basis of trust for exchange. How do you know you are exchanging with the right party? How do you protect integrity in transit?
The Verklaring van Toepasselijkheid (VvT, Statement of Applicability)
You do not have to implement all the controls in NEN 7510-2. You select the controls that suit your risks. But you must be able to explain why you have or have not chosen controls.
You record this in the Verklaring van Toepasselijkheid (VvT, Statement of Applicability). For each control, you document whether you have selected it and why. If you do not select a control, you explain why not.
The VvT is a mandatory document for certification. The auditor checks whether your choices are logical given your risk analysis.
Documentation required for NEN 7510
NEN 7510 explicitly requires a number of documents:
- Scope of the ISMS
- Information security policy
- Risk assessment methodology
- Results of the risk assessment
- Risk treatment plan
- Statement of Applicability (VvT)
- Information security objectives
- Evidence of competences
- Results of internal audits
- Results of management reviews
- Nonconformities and corrective actions
In addition, you decide which further documentation you need to make the system work. Keep it manageable: document what is needed, not more.
Difference between NEN 7510 and ISO 27001
For those familiar with ISO 27001: NEN 7510 is not radically different. The structure is the same, and most requirements match.
The differences lie in:
- Healthcare-specific controls (logging, treatment relationship)
- References to Dutch healthcare legislation
- NEN 7512 and NEN 7513 as additional standards
- Specific attention to medical equipment
- Focus on patient data rather than general information
If you already have ISO 27001, the step to NEN 7510 is relatively small. You add the healthcare-specific elements to your existing system.
Read more about the differences between NEN 7510 and ISO 27001.
Next step
Read about the audit process to understand how the certification audit works, look at the step-by-step plan for the practical approach, or use the NEN 7510 checklist to check whether your ISMS is ready for certification. For a full overview of the documentation the standard requires, see mandatory documents for NEN 7510. If your organisation actively exchanges data with other care partners, also read about NEN 7512, which elaborates on the exchange requirements.