The NEN 7510 certification process
You go through six steps from decision to certificate. Count on two to eighteen months, depending on your organisation size and starting position.
The six steps to certification
- Determine scope - Which locations, systems and processes are covered by the ISMS? In most healthcare organisations this is the entire organisation.
- Perform Risk Assessment - Identify risks to patient data and healthcare information. What threats are there? What are the consequences? This is the heart of NEN 7510.
- Set up ISMS - Implement controls, establish policies, train employees, document processes.
- Complete proof period - Work under your ISMS for a minimum of three months. Auditors want proof that the system works in practice.
- Internal audit and management review - Check yourself whether everything is working and have management formally assess the ISMS.
- External audit - The certification body carries out the audit in two phases. If successful you will receive the certificate.
Who does what?
You / information security
Risk analysis, setting up ISMS, internal audits
IT department
Technical measures, logging, monitoring
Data Protection Officer
GDPR alignment, privacy aspects
Consultant (optional)
Guidance, gap analysis, templates
Certification body
Perform audit, issue certificate
Good to know: A consultant is not mandatory. Organisations with experienced IT and compliance people regularly do it themselves.
Preparation for NEN 7510
Good preparation is half the battle. Most of the time is spent on the risk analysis and setting up your ISMS, not on the audit itself.
What do you need to arrange internally?
Then follow these steps:
- Appoint project leader - Someone with a mandate who takes the lead
- Determine scope - Which systems, locations, processes?
- Perform risk analysis - Focus on patient data and healthcare systems
- Implement measures - Technically and organizationally
- Employee training - Awareness about information security
- Start proof period - Work for at least three months according to ISMS
- Perform internal audit - Test whether everything works
What documentation is needed?
Information Security Policy
Your vision and objectives
Scope of the ISMS
Which parts of your organisation
Risk analysis and treatment plan
Identified risks and chosen measures
Statement of Applicability
Which controls you apply and which you do not
Process descriptions
Incident management, access management, etc.
Registrations
Evidence of compliance (audits, incidents, training)
Care-specific documentation:
- Policy for access to patient records
- Logging policy (in accordance with NEN 7513)
- Data exchange policy (in accordance with NEN 7512)
- Agreements with processors and subcontractors
Three common mistakes
Mistake 2: Paper tiger
Your documents must correspond with the practice. If you write down that you will check access logs weekly, you should do so. Auditors ask for evidence.
Mistake 3: Starting the proof period too late
You must have worked under your ISMS for at least three months before the external audit. Plan this.
Read also: How do you prepare for a certification audit? - Practical tips that also apply to NEN 7510.