Your partner for NEN 7510 management, implementation and internal auditing
NEN 7510 helps healthcare organizations structurally strengthen their information security and better protect medical data. By implementing this standard, you show patients, partners, and regulators that you handle their data responsibly. Nestor Security helps organizations with this – with a success rate of 100%.
✓“Clients are increasingly asking for NEN 7510 compliance.â€
✓“During an inspection by the IGJ, we want to have nothing to explain.â€
✓“We want to restrict unauthorized access to medical records.â€
Find out why 500+ Companies trust Nestor Security for IT security and compliance
What it yields
Why NEN 7510 is essential for your organization
In healthcare, information security is not a formality, but a legal obligation and a prerequisite for trust. This is what demonstrable NEN 7510 compliance delivers for you.
Comply demonstrably with the law
Work in accordance with the standards prescribed by the Wabvpz, the BEGZ and the BSN regulation, and directly demonstrate to the IGJ that you comply.
Win the trust of patients & partners
Show patients, health insurers, and chain partners that medical data is confidential, integral, and available with you.
Ensure the continuity of care
Protect your organization against data breaches and downtime. A tested continuity plan ensures that care continues even during incidents.
Win contracts in the supply chain
Health insurers and hospitals are increasingly setting NEN 7510 as a requirement. Those who comply remain eligible for contracts and tenders.
The approach
How we make NEN 7510 compliance clear and hassle-free
You do not have to decipher the standard all by yourself. We make the process predictable, from the initial baseline measurement to the certificate.
Without support
Figure it out yourself, slow and uncertain
Figuring out the standard and healthcare-specific requirements yourself
Uncertain whether you will pass the IGJ assessment
Unpredictable lead time and costs
Policy that looks good on paper, but doesn't work in practice
RECOMMENDED
Met Nestor Security
Guided, predictable, and certain
A risk-based approach proven in healthcare
Clear scope, timeline, and costs upfront
Measures that align with your care processes
Our customers' 100% passes the external final audit
The process
From baseline measurement to NEN 7510 certificate in six steps
A NEN 7510 implementation process takes an average of six to twelve months, shorter if you already work with ISO 27001. We guide every step and keep it manageable and predictable.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Typical blockade
A scope that is too narrow ('IT only') while NEN 7510 is about the entire care process, or overestimating one's own starting position.
How we help
We conduct an objective baseline measurement and jointly define a scope that covers the care processes while remaining feasible.
Step 1
Baseline measurement & gap analysis
What happens
Assess current security against NEN 7510-1 and -2
Documenting differences in a gap report
Determine scope surrounding the primary care process
Identify priorities and quick wins
About the standard
Why NEN 7510 is important in healthcare
NEN 7510 builds upon ISO 27001, adds healthcare-specific requirements, and brings together the legal obligations in healthcare into a single standard.
Building on ISO 27001
NEN 7510 includes all requirements of ISO 27001 and ISO 27002, supplemented by the healthcare guidelines from ISO 27799. Anyone who implements NEN 7510 largely complies with ISO 27001 as well.
Healthcare-specific measures
On top of ISO 27001, the standard requires logging of file access, strict access control with 2FA and RBAC, a tested continuity plan, and the management of client consent.
The NEN 7510 family
NEN 7510 is certifiable; NEN 7512 (secure data exchange) and NEN 7513 (logging of file access) are in-depth standards that are assessed during the audit.
The common denominator
A single functioning management system brings together the requirements of the GDPR, healthcare legislation, IGJ supervision, and NIS2, demonstrably and future-proof.
Our approach
Why healthcare organizations choose Nestor Security
NEN 7510 is not a paper formality, but structural risk management. We make it demonstrable and workable, with an approach tailored to healthcare.
Healthcare specialists
Our auditors not only know NEN 7510, 7512, and 7513, but also understand the healthcare processes, systems, and sensitive data you work with every day.
Proven results
Under our guidance, every client passes the final audit, from the initial baseline measurement to the certificate.
Pragmatic & risk-based
No thick binders for show, but measures that fit your scope, size, and risk profile. This keeps the process manageable.
From baseline measurement to recertification
A single point of contact who guides you through the entire process and will continue to support you afterwards with surveillance audits and recertification.
Success stories
Don't just take it from us
Healthcare and knowledge organizations preceded you.
Contact
Meet Nestor Security
Your questions answered
FAQs
What is NEN 7510?
NEN 7510 is the standard for information security within the healthcare sector. The standard provides guidelines on how healthcare organizations can organize their information security. Central to this is the information security management system, also known as an ISMS. In addition, the standard describes a series of measures that organizations can use to control or reduce risks.
What does NEN 7510 cost?
The cost of a NEN 7510 certification depends on your organization (such as size, IT complexity and existing measures) and the choices you make (for example, whether to use external guidance). There is therefore no fixed rate, but you can get an indication of what you can approximately expect.
Indication of costs (excluding VAT)
In general, you can consider the cost items below:
- Preparation and baseline measurement: ± €1,000 – €3,000
- Certification audit (initial): ± €3,000 – €10,000
- Annual follow-up audits: ± €2,000 – €4,000 per year
This is a guideline. Your final investment may be higher, depending on, for example, the use of external consultants, the size of the scope, or the internal hours your organization spends.
What's in NEN 7510?
The NEN 7510 works according to a quality cycle, also known as the PDCA cycle (plan, do, check, act). First, you conduct a risk analysis to gain insight into potential threats. Based on this, you determine which measures are necessary (plan) and put these measures into practice (do). Next, you regularly monitor whether the measures have the desired effect (check). If necessary, you apply improvements to optimize the results (act).
Does my organization need to comply with NEN 7510?
The NEN 7510 applies to all healthcare providers who process personal data in a healthcare information system. It is important that you can demonstrate that you work according to this standard. There is a similar standard for organizations in youth care: the ISO 27001, which has many similarities to the NEN 7510.
Why is working according to NEN 7510 a requirement?
Since 2008, it has been a legal requirement for healthcare providers to comply with NEN 7510. This is stated in the Supplementary Provisions for Processing Personal Data in Healthcare Act (Wabvpz). The Regulation on the Use of Citizen Service Number in Healthcare and the Decree on Electronic Data Processing by Healthcare Providers also refer explicitly to this standard. As a result, organizations must follow the NEN 7510 when managing, securing and using a healthcare information system. An exception applies to providers in youth care: they follow a similar standard, the ISO 27001, which is included in the regulation Jeugdwet.
In addition, the General Data Protection Regulation (AVG) applies, which requires organizations to take appropriate technical and organizational measures to protect personal data.
What exactly does working according to the NEN 7510 standard entail?
Working according to NEN 7510 means that the information security management system (ISMS) is functioning effectively. This allows an organization to demonstrate that the information security quality cycle is being properly applied. It is not enough just to have policies and measures on paper; the organization must also verify that these measures are actually working and implement improvements where necessary. In addition, the NEN 7510 states that information security must be independently assessed on a regular basis.
What are the benefits of demonstrating NEN 7510 compliance?
A NEN 7510 certificate is clear proof that your organization works according to the standard.
There are different types of certificates. To keep the certificate valid, the certifying organization periodically checks that your organization still meets the standard. Often the certificate also describes how the quality of this testing is checked and by whom. For example, the Accreditation Council can verify that the certifying organization is testing and certifying correctly. In this way, a certificate provides additional assurance, also for external parties.