Frameworks · NEN 7510
The Dutch standard for information security in healthcare, mandatory for every healthcare provider that processes data in a healthcare information system. Part 1 is the management system, part 2 the controls, both aligned with ISO 27001 and 27002. In short: implement the measures and have an independent party establish that they work.
What it requires
Part 1 requires an information security management system: assess risks, select measures and monitor their operation. The IGJ expects you to comply demonstrably, not just on paper.
Part 2 follows the four themes of ISO 27002:2022: organisational, people, physical and technological, with care-specific additions. Technical measures such as access management and secure configuration must demonstrably be in place.
A certificate is not mandatory, but the ISMS and the measures must be independently assessed at least once every 3 years. That only works with evidence an assessor can verify.
How you make it demonstrable
Easy2audit measures your systems and accounts against the technical controls of the controls from part 2 of NEN 7510, in particular the technological theme, and scores the same scan against the other frameworks as well.
In Easy2audit, NEN 7510-1+2:2024 follows the four control chapters of part 2: organisational (5), people (6), physical (7) and technological (8), with the Dutch measure names from the standard. Per measure, from 5.3 segregation of duties to 8.5 secure authentication, you see the measured settings and which systems deviate.
demo environment · sample scores · a selection, the application covers the full framework
Also measured
also available: NIST benchmarks · ISA 315 reporting for the financial statement audit