NEN 7510 certification step by step

From zero to a NEN 7510  certificate: this step-by-step plan shows how to approach it. The standard is freely available through NEN Connect , and certification runs through an accredited body . The route is similar to other management system certifications, but with healthcare-specific emphases.

Overview of the NEN 7510 project

For most organisations, an NEN 7510 implementation project takes 6 to 12 months. Smaller organisations with a good starting position can move faster. Large, complex healthcare organisations need more time.

The project consists of three phases: prepare, implement and certify. We work out each phase below.

Phase 1: Prepare

Step 1: Define the scope

What falls within your NEN 7510 certification? For many organisations, this is the whole organisation. But you can also choose a specific part, for example one service or location.

When defining the scope, think about which patient data you process, which systems and processes are involved, which locations and employees are included, and which suppliers have access to your systems.

The scope must be logically defined. An auditor will not accept artificial boundaries that exclude difficult parts.

Step 2: Carry out a gap analysis

Where do you stand now against NEN 7510? A gap analysis maps this out. You go through the requirements of the standard and assess for each one whether you already meet it, partly meet it, or have nothing in place yet.

The result is an overview of “gaps”: the points where you still have work to do. This gives direction to your implementation project and helps you estimate the time and resources needed.

You can do a gap analysis yourself with the standard in hand, or ask an external consultant to take a look. An external view is more objective, but it costs money.

Step 3: Secure commitment from management

NEN 7510 explicitly requires the involvement of management. This is not a formality. Management must free up resources, set policy and assign responsibilities.

Make sure management understands what NEN 7510 involves, why it matters and what it requires. A certification project without management commitment will sooner or later stall.

Step 4: Form a project team

Who will lead the project? You need at least a project lead who keeps the overview and monitors progress. In addition, involve people from the relevant departments: IT, care delivery, HR, facilities.

In smaller organisations, this is often a small group or even one person with support. In large healthcare organisations, you work with a project group and a steering group.

Consider external support if you do not have the expertise in-house. A consultant can help interpret the standard and set up the system.

Step 5: Make a project plan

Based on the gap analysis, you draw up a project plan. Which activities are needed? In what order? Who is responsible? When must it be finished?

Take into account the certification date you have in mind. Work back from it to a start date, and plan the activities. Build in slack for setbacks.

Phase 2: Implement

Step 6: Set policy and objectives

Management adopts the information security policy. This policy describes the intentions and direction of the organisation in the field of information security. It must include a commitment to protecting patient data and to continual improvement.

Also formulate concrete objectives. What do you want to achieve? Examples: “No data breaches involving patient data”, “All employees trained in information security”, “Uptime of critical systems of at least 99.5%”.

Step 7: Carry out a risk analysis

The risk analysis is the heart of NEN 7510. You identify the risks to the availability, integrity and confidentiality of patient data. Then you assess the likelihood and impact of each risk.

For the risk analysis, think of technical risks such as ransomware, data breaches and system outages. But also human risks: errors, unauthorised access, social engineering. And physical risks: fire, break-ins, water damage.

The outcome determines which measures you need to take. High risks require strong measures. Low risks can be accepted or covered with lighter measures.

Step 8: Select and implement control measures

Based on the risk analysis, you select control measures from NEN 7510-2. The standard offers an extensive list of possible measures, organised into categories: organisational, people, physical and technical.

You do not have to implement everything. You choose the measures that fit your risks and your situation. You must, however, be able to explain why you have or have not chosen certain measures. You record this in a Verklaring van Toepasselijkheid (VvT, statement of applicability).

Implementing measures often takes the most time. Technical measures such as encryption or access management require configuration and testing. Organisational measures such as procedures and training require coordination and communication.

Step 9: Document the system

NEN 7510 requires documented information. You record what you do and how you do it. As a minimum, document the information security policy, the scope, the risk analysis, the statement of applicability and the most important procedures.

Keep the documentation manageable. The aim is not to produce paper, but to make clear how you work. Short, clear documents work better than thick handbooks that nobody reads.

Step 10: Train employees

Employees must know what is expected of them in information security. Organise awareness training for all employees. Specific roles, such as systems administrators, need more in-depth training.

Training is not a one-off action. Repeat it periodically, for example annually. New employees receive training when they join.

Step 11: Implement logging and monitoring

NEN 7513 sets specific requirements for logging in healthcare. You must be able to record who had access to which patient data, and when. This is essential for accountability and incident investigation.

Implement logging on your systems and make sure the logs are kept in line with the statutory retention periods. Actively monitor for suspicious activity.

Phase 3: Certify

Step 12: Carry out internal audits

Before you request the certification audit, check for yourself whether your system works. The internal audit checks whether you meet the requirements of NEN 7510 and your own procedures.

The internal auditor must be independent: you cannot audit your own work. In smaller organisations, this is difficult. One solution is to have departments audit each other, or to hire an external auditor for the internal audit.

Record findings and address deviations before you request the external audit.

Step 13: Hold a management review

Management periodically reviews how the ISMS is performing. This is a mandatory part of the standard. In the management review, you discuss the status of the system, the results of audits, incidents and opportunities for improvement.

The management review produces decisions about changes to policy, resources and objectives.

Step 14: Choose a certification body

Not every certification body may certify NEN 7510. Choose a body that is accredited for NEN 7510 by the Dutch Accreditation Council (Raad voor Accreditatie, RvA). This guarantees that the audit meets the requirements.

Certification bodies for NEN 7510 in the Netherlands include Kiwa, DNV, TÜV, DEKRA and LRQA. Ask for quotes and compare on price, experience in the healthcare sector and availability.

Step 15: Go through the certification audit

The certification audit consists of two stages.

Stage 1 is a documentation review. The auditor assesses your documentation: policy, risk analysis, statement of applicability, procedures. This can often be done remotely. The auditor determines whether you are ready for stage 2.

Stage 2 is the implementation audit. The auditor visits your site and checks whether you do in practice what you have documented. This happens through interviews with employees, observations and sample checks. The auditor looks for evidence that the system works.

After the audit, you receive a report with findings. If there are no findings or only minor ones, the certificate is granted. If there are major findings, you must correct them before the certificate can be issued.

Step 16: Maintain the certificate

The NEN 7510 certificate is valid for three years. Each year, a surveillance audit follows in which the certification body checks that you still comply. After three years, a recertification audit follows.

But certification is not the end point. You must keep the system running: update risk analyses, improve procedures, train employees, handle incidents. Continual improvement is a core principle of the standard.

Common mistakes in NEN 7510 implementation

Starting the risk analysis too late. The risk analysis determines which measures you need. Start it early, not halfway through the project.

Documentation disconnected from practice. Do not write procedures that nobody follows. Document what you actually do, or change practice to match the documentation.

Underestimating training and awareness. Technical measures are important, but people are often the weakest link. Invest in training.

Not involving management. An ISMS without management commitment is a paper tiger. Make sure management is and stays involved.

Too little time for internal audits. The internal audit is your last check before the external auditor arrives. Give yourself time to resolve findings.

Need help?

You can implement NEN 7510 yourself, but external help can be valuable. A consultant helps with interpreting the standard, setting up the system and preparing for the audit.

Choose a consultant with proven experience in healthcare and with NEN 7510. Ask for references. A good consultant makes themselves redundant: after the project, you can maintain the system yourself.

To see who should take on the project lead role, read who leads the project. Not sure whether to do it yourself? See implement yourself or with a consultant.

Next step

Read more about the costs and lead time of NEN 7510 certification, or look at the requirements of the standard in detail. When you are ready to check whether your ISMS is complete, use the NEN 7510 checklist to prepare for your internal audit.