NEN 7510:2017 Checklist

Step 1: understanding the standard

The NEN 7510 standard consists of two parts. Part 1 of the standard is about the management system, while part 2 is about the control measures you can take to mitigate risks and comply with requirements.

A NEN 7510 certification is generally not mandatory, but a healthcare stakeholder may only work with organisations that have NEN 7510 certification. To obtain certification, a NEN 7510 audit is first required. DigiTrust can help you with this

Step 2: Define your scope

Determine what the scope is going to be of your information security management system. For NEN7510 certification, it is mandatory to have the primary care process in scope

Step 3: Assessing risks

Once you have a good idea of the scope and requirements for the NEN 7510 it is important to identify the risks within your (healthcare) organisation. A risk assessment place, revealing what threats exist and how likely they are to occur. But also what the impact will be on your healthcare organisation if they do occur unexpectedly. Together, this gives you a good picture of the information security / cyber risks.

Step 4: Addressing risks

After assessing the risks, it is important to address them. The risk treatment plan allows you to record the measures and determine what you will do to reduce the risk. You may have already taken several measures, so the residual risk can be accepted. But you may need to take additional measures on certain risks to arrive at an acceptable residual risk. For each risk, it is important to indicate how 'heavily' the risk weighs and what appropriate measure will be taken for it. Compare all your self-determined measures with the Appendix A measures. To assess whether you haven't forgotten anything. These measures are further detailed in the NEN7510-2.

Tip: the measures to be taken are mostly preventive, to avoid problems.

Step 5: Declaration of applicability (VVT)

The Statement of Applicability is an important document within NEN 7510. For each section, it helps you argue which parts of Annex A of the standard are or are not applicable within your healthcare organisation.

Note: take steps 1 to 3 first, before getting started with the VVT. This helps take into account the risk-sensitive situations for your organisation and the right scope.

Step 6: Taking stock

After you have also drawn up the VVT, it is time to take stock, as you have already taken a large number of steps within the NEN 7510 checklist. The idea is to review the entire process again. Have you not overlooked anything? And what do you do if the measures indicated do not have the desired effect and the risks remain? Performing an internal audit in advance will give you a good picture of your information security management system.

Step 7: Creating policies

Finally, you can get to work on information security policies. It should provide direction and support for information security within your healthcare organisation. Of course, based on the policy, you will act in line with the requirements, relevant laws and, of course, the regulations from the NEN 5710 standard.