Netherlands NEN 7510

Dutch healthcare information security standard - access control, integrity, availability, audit.


Short name	NEN 7510
Region	Europe
Country or scope	Netherlands
Sector	Healthcare
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers NEN 7510

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for NEN 7510.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for NEN 7510 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`NL-NEN7510-ASSET` Inventory of Assets	Assets associated with information and processing facilities must be identified and inventoried; a populated software component inventory is the SBOM-level expression of this control (NEN 7510-2, asset-inventory control per ISO 27002 lineage)	Scan
`NL-NEN7510-VULN` Technical Vulnerability Management	Information about technical vulnerabilities of systems in use must be obtained and exposure evaluated in a timely fashion, which requires each component's version to be known (NEN 7510-2, technical vulnerability management control)	Scan
`NL-NEN7510-INT` Integrity of Health Information Systems	Health information systems must protect the integrity of patient data, evidenced at the software level by verifiable integrity hashes over deployed components (NEN 7510-2, integrity controls)	Scan
`NL-NEN7510-SUP` Supplier Relationships	Security requirements must be agreed and monitored across supplier relationships touching health information, presupposing that the supplier behind each software component is recorded (NEN 7510-2, supplier relationship controls)	Scan
`NL-NEN7510-ID` Unambiguous Asset Identification	Effective access control and auditing of healthcare systems require the software estate to be unambiguously identifiable through standard identifiers (NEN 7510-2, asset management and audit controls)	Scan
`NL-NEN7510-DOC` Documented Operating Environment	Operating procedures and system documentation must be maintained and available; an identified, timestamped SBOM document is part of a documented operating environment (NEN 7510-2, documented operating procedures control)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`NEN7510-5`	Information Security Policies (Clause 5)
`NEN7510-6`	Organisation of Information Security (Clause 6)
`NEN7510-8`	Asset Management (Clause 8)
`NEN7510-9`	Access Control for Patient Data (Clause 9)
`NEN7510-10`	Cryptography for Health Data (Clause 10)
`NEN7510-12`	Operations Security (Clause 12)
`NEN7510-14`	System Acquisition and Secure Development (Clause 14)
`NEN7510-16`	Information Security Incident Management (Clause 16)
`NEN7510-18`	Compliance and Privacy Obligations (Clause 18)

Policy templates

Written for NEN 7510:

NEN 7510: Privacy Notice (Healthcare)
NEN 7510: Information Security Incident & Breach Notification Procedure
NEN 7510: Access Control Policy for Patient Data

And 22 from the standard set, adapted to NEN 7510.