NEN 7510 statement of applicability with example
A statement of applicability (VvT, Verklaring van toepasselijkheid) shows which control measures you apply in your healthcare organisation, which ones you do not apply, and what evidence supports that. Use the VvT together with your NEN 7510 risk analysis, overview of measures and NEN 7510 requirements. You can find the current standard and tools via NEN and NEN Connect.
The VvT is not a filled-in copy of ISO 27001 templates. NEN 7510 works with a management system for information security and with care-specific risks around personal health information. For each measure, you make a deliberate choice, link it to a risk and an owner, and show how the measure works in practice.
Which columns do you need?
Keep the VvT compact enough to maintain. Include at least: measure reference, risk, applicable yes/no, reason, implementation status, owner, evidence and date of the last review. Add a field for residual action if a measure does not yet work fully.
| Column | What do you write? |
|---|---|
| Risk | What can happen to availability, integrity or confidentiality? |
| Applicability | Applicable or not applicable, with justification |
| Implementation status | Not started, partly or fully implemented |
| Reason | Why does this choice fit the scope and risk? |
| Evidence | Procedure, configuration, log, contract, test or audit report |
| Owner | Who keeps the measure working? |
| Review | When was the choice last reviewed? |
Use “not applicable” sparingly. “We are small” is not a reason. Describe which activity falls outside the scope, which risk therefore does not exist, and how you check that the scope does not change. A measure can also be partly applicable. In that case, describe which part applies and which residual action is still open.
Fictional example: ThuiszorgSamen
Fictional example. ThuiszorgSamen manages an electronic client record (ECD), uses a cloud supplier and exchanges information with GPs. The organisation chooses three example rows for its VvT.
| Control theme | Risk and choice | Status and evidence | Owner |
|---|---|---|---|
| Access to records | Unauthorised viewing through broad ECD roles. Applicable. | Implemented; role matrix, authorisation review and ECD configuration | Functional management |
| Logging of viewing | Misuse goes unnoticed. Applicable. | Partly; monthly sample works, export to the incident process is missing | Privacy and security |
| Supplier assessment | Cloud provider changes security without oversight. Applicable. | Implemented; contract, assurance report and yearly assessment | Contract owner |
| Own software development | ThuiszorgSamen does not develop software. Not applicable, provided this is justified in the scope and supplier process. | Scope statement and contract check | IT coordinator |
The logging row refers to a specific problem and an open action. “Logging is switched on” would say too little: you would not know who reviews the logs, how often, or what happens when there is a deviation. The VvT should lead the reader to that evidence.
From risk to evidence
Update the VvT after your risk analysis has changed. When a new ECD is introduced, check not only the technical configuration but also the role allocation, supplier agreements, logging and recovery test. Have the owner assess the change and note the date. This way the VvT remains a living management decision.
A useful evidence reference is specific: “ECD authorisation review Q2 2026, ticket AR-184, sample of 25 accounts”. A generic reference such as “information security policy” makes checking unnecessarily slow. Store sensitive evidence according to your own access and retention policy. The VvT can refer to evidence without copying patient data.
The VvT is a management document. The standard text sets the requirements. The table, status labels and review frequency below are a practical way of working from Normwijzer.
Review and decision-making
Discuss the VvT at least when there are major changes and during the planned management review. Use the same questions for each row: is the risk still current, does the measure demonstrably work, is the owner correct, and is the evidence recent enough? Record decisions and open actions. An auditor or independent reviewer must be able to follow how the choice was made.
The IGJ expects healthcare providers to show not only plans, but also how measures work and what evidence exists. A VvT without links to tests, records or observations therefore remains an administrative list.
Frequently asked questions
Must every measure be “yes”?
No. You make choices based on scope and risk. A measure that is not applicable must still have a verifiable reason and a responsible owner.
May I copy the VvT of another healthcare organisation?
Use an example at most as a structure. Your own risks, systems, suppliers and scope determine the content. A copied table does not provide reliable evidence.
Is a VvT the same as an audit report?
No. The VvT describes choices and status. An audit report assesses whether the management system and the measures meet the requirements and work.