Phase 1: Documentation and readiness check(often partly remote)
The auditor assesses your ISMS documentation: policy, risk analysis, Statement of Applicability. Is everything there? Are you ready for the on-site audit?
Phase 2: On-site audit(on location)
The auditor visits, speaks to employees, examines systems and processes, checks logging and registrations. It revolves around the question: does paper correspond to practice?
“
The gist: The auditor is looking for evidence that your ISMS is effective. Not just that procedures exist, but that they work.
Questions about NEN 7510
What is the difference between NEN 7510 and ISO 27001?
NEN 7510 is based on ISO 27001 but contains additional requirements specific to the healthcare sector, such as protecting patient data and medical equipment. ISO 27001 is international, NEN 7510 is Dutch and healthcare-specific. Many organisations combine both standards.
For a small healthcare practice (GP, physiotherapist), NEN 7510 certification usually costs €5,000 to €8,000 in the first year. Medium-sized healthcare institutions pay €8,000 to €15,000. After that you pay €2,000 to €5,000 a year for surveillance audits.
For a small, well-prepared practice: two to four months. Medium-sized healthcare institutions: six to twelve months. Large hospitals: twelve to eighteen months. The audit itself takes two to five days.
Working in line with NEN 7510 is a legal requirement for all Dutch healthcare providers (Decree on electronic data processing by healthcare providers). Certification itself is not mandatory, but it is the most common way to demonstrate compliance to supervisors and partners in the care chain.
Can I combine NEN 7510 with ISO 27001?
Yes, and that is often efficient. Both standards share the same structure. The certification audit can be combined, which saves time and costs. This is especially relevant for IT service providers that also serve healthcare clients.
Which certification bodies may certify NEN 7510?
Only accredited certification bodies may certify NEN 7510. In the Netherlands, these include Brand Compliance, BSI, DEKRA, DNV, Kiwa, LRQA and TÜV NORD.
What are NEN 7512 and NEN 7513?
NEN 7512 covers secure data exchange between healthcare providers. NEN 7513 sets requirements for logging access to patient records. Both build on NEN 7510 and cannot be certified separately.
