Risk analysis for NEN 7510

The risk analysis is where everything starts with NEN 7510 . Z-CERT shares threat information specific to the healthcare sector, and the NCSC (Dutch National Cyber Security Centre) provides general cybersecurity guidance. A well-executed risk analysis is the foundation of your information security system. A poorly executed one leads to misplaced priorities and blind spots.

Why a risk analysis for NEN 7510?

NEN 7510 is not a checklist you work through blindly. The standard asks you to take measures that fit your risks. That means you first need to know which risks you face.

A GP practice has different risks from an academic hospital. An EHR supplier has different risks from a manufacturer of MRI scanners. By analysing your risks, you can focus your efforts on what really matters.

The risk analysis also prevents overkill. If you implemented every conceivable measure, you would go bankrupt or get stuck in bureaucracy. By focusing on realistic risks, you keep things manageable.

The basic steps of a NEN 7510 risk analysis

A risk analysis for NEN 7510 follows a logical order: take inventory, assess, treat.

Take inventory: Which information do you process? Which systems do you use? Which threats are relevant? Which vulnerabilities do you have?

Assess: How likely is it that a threat will materialise? What is the impact if it does? This gives you a risk score.

Treat: What do you do about each risk? Accept it, reduce it, transfer it or avoid it? Which measures do you take?

This is not a one-off exercise. The risk analysis is a living document. You repeat it periodically and after significant changes.

Step 1: Take inventory of your information

Start with the question: which information do you process that needs protection?

In healthcare, part of the answer is obvious: patient data. But look more broadly. You also have personnel data that is sensitive for privacy. Financial information that is confidential. Business information such as contracts and strategic plans. And perhaps research data, clinical trial data or intellectual property.

Make an overview. Where is this data stored? In which systems? Who has access to it? This is your information inventory, the basis for everything else.

Focus on what really matters. You do not need to catalogue every piece of paper. Concentrate on the information that would have serious consequences if something went wrong with it.

Step 2: Identify threats

Threats are the things that can go wrong. They come from outside (external threats) or from inside (internal threats).

External threats in healthcare:

Ransomware attacks. Cybercriminals encrypt your systems and demand a ransom. Healthcare is a popular target because downtime directly affects patient care.
Data breaches by hackers. Patient data is valuable on the black market.
Phishing and social engineering. Employees are tricked into giving away data or access.
DDoS attacks. Your systems are flooded and made unreachable.

Internal threats:

Employee errors. Wrong address on an email, a lost USB stick, a stolen laptop.
Unauthorised access. Curious colleagues looking at records they have no business viewing.
Malicious employees. Rare but real: someone who deliberately causes harm.

Physical threats:

Fire, water damage, power cuts.
Break-ins or theft of equipment.

Technical threats:

System failure caused by hardware or software.
Loss of data through corruption or configuration errors.
Software vulnerabilities that are exploited.

Make this concrete for your own situation. Which threats are realistic for your organisation?

Step 3: Identify vulnerabilities

A threat only becomes a risk when there is a vulnerability that can be exploited. Vulnerabilities are the weak spots.

Technical vulnerabilities are the easiest to find. Software that has not been updated. Systems without adequate access protection. Networks without segmentation. Missing encryption.

Human vulnerabilities are harder to spot but just as relevant. Employees who have not been trained. A culture in which security is not taken seriously. Procedures that are not followed. High workloads that lead to shortcuts.

Organisational vulnerabilities: missing policy, unclear responsibilities, a lack of budget for security.

Step 4: Assess the risks

Now you combine threats and vulnerabilities into risks. For each risk, you assess two things: how likely is it, and how serious is it if it happens?

Likelihood: How often do incidents like this happen in comparable organisations? How attractive is your organisation as a target? How vulnerable are you?

Impact: What happens if this risk materialises? Think of harm to patient care (the most important factor in healthcare), financial loss, reputational damage, legal consequences and operational disruption.

In healthcare, the impact of data breaches and system outages is almost by definition high. Patient data is especially sensitive. A system outage can cost lives. This lowers the threshold for taking measures compared with other sectors.

Use a simple scale: high, medium, low. Or a numerical scale from 1 to 5. The point is not false precision, but being able to distinguish between risks that are urgent and risks that can wait.

Step 5: Decide on the treatment

For each identified risk, you decide what to do. There are four options.

Avoid: You eliminate the activity that causes the risk. For example, you stop processing a certain type of data.

Reduce: You take measures to lower the likelihood or the impact. This is the most common approach. You implement control measures.

Transfer: You pass the risk on to another party, usually through insurance or outsourcing. This only works for financial impact, not for reputation or legal responsibility.

Accept: You do nothing and accept the risk. This is valid for small risks, but you must do it deliberately and document it.

For the risks you reduce, you select measures from NEN 7510-2. You choose from technical and organisational measures. This is where the Verklaring van Toepasselijkheid (statement of applicability) comes from: which measures do you choose, which do you not, and why?

Healthcare-specific risks

Healthcare has risks that are less prominent in other sectors.

Direct patient harm. In most sectors, a system outage is annoying. In healthcare, it can have life-threatening consequences. An EHR outage during an acute situation, medication errors caused by wrong data, diagnostics that cannot be reached.

Special category personal data. Medical data is especially sensitive under the GDPR. A data breach involving diagnoses or treatments has more impact than one involving address details. The fines and reputational damage are correspondingly higher.

Compliance risks. The healthcare sector is heavily regulated. Failing to comply with NEN 7510, the GDPR, or soon NIS2 and the Cyber Security Act has consequences. The IGJ supervises and can impose measures.

Medical equipment. Unlike office environments, healthcare deals with network-connected medical equipment. Insulin pumps, pacemakers, infusion systems, MRI scanners. This equipment is often harder to secure than standard IT.

Dependence on the chain. Care is teamwork. Data flows between GP, specialist, pharmacy and laboratory. An incident at one party affects the whole chain.

The link with the RI&E

In working conditions legislation, you will know the RI&E (risk inventory and evaluation). That covers physical safety and working conditions.

The risk analysis for NEN 7510 covers information security. These are different analyses with different scopes. But there are overlaps. A fire is both an occupational safety risk and an information security risk (think of loss of data). The same goes for a burglary.

Some organisations integrate the analyses. That can be efficient, but make sure you keep the specific focus. An RI&E consultant is not necessarily an information security expert.

Documentation and maintenance of the NEN 7510 risk analysis

You must document the risk analysis. This is required for NEN 7510 certification. The auditor wants to see what you analysed, how you reached your judgements, and which treatment you chose.

The documentation does not need to be thick reports. A clear spreadsheet with risks, assessments and measures works well, as long as it is traceable and complete.

The risk analysis is not a one-off exercise. Plan periodic updates, for example annually. And update in between when there are significant changes: new systems, new services, incidents that reveal blind spots.

An outdated risk analysis is dangerous. Your measures are based on a picture that no longer holds. New risks go unnoticed. Keep the analysis alive.

The asset register is the starting point for the risk analysis. See NEN 7510 register: the asset register.

Getting started with the NEN 7510 risk analysis

If you do not yet have a risk analysis, this is how to approach it.

Map your most important systems and information flows. Your EHR/hospital information system (HIS), your network, your connections. Who has access?

Identify the threats that are relevant in healthcare. Ransomware, data breaches, unauthorised access. How vulnerable are you?

Assess the risks roughly. What is high, what is low? Focus first on the high risks.

Decide what you will do. Which measures will you take? Plan the implementation.

Document what you have done. That is your first risk analysis. Not perfect, but a start. You refine it later.