NEN 7510 Baseline Assessment

The foundation for your certification.

Implementing NEN 7510 often seems like an enormous amount of work. The fear that processes will have to be overhauled, that care will be put at risk, or that costs will get out of hand keeps growing.

Schedule your NEN Baseline Assessment

The NEN 7510 baseline assessment is a one-day review in which a senior consultant maps your information security against every requirement of the Dutch healthcare standard. Within 48 hours of the site visit you receive a complete report with your strengths, the gaps around patient data and a concrete action plan. Fixed price: 1,250 euros.

The fear of an enormous amount of work

  • “Will our processes have to be overhauled?”
  • “Will care be put at risk?”
  • “Will costs get out of hand?”

We see it in many healthcare organizations: the will is there, but nobody knows how big the mountain of work really is. So it gets postponed, while the inspectorate's requirements and the questions from chain partners keep piling up and the certificate that should bring calm stays out of reach.

Our baseline assessment removes that uncertainty. It is the starting signal for your implementation process. Whether you are a healthcare institution, practice, or supplier: you are already doing many things right, often without realizing it, when it comes to patient privacy and data security. We make sure that becomes visible.

A deep dive into your organization, without disruption.

The baseline assessment makes the mountain measurable in one day. What remains is a concrete plan instead of a vague feeling. The postponing stops, your chain partners see you are in control, and the route to the certificate lies ahead in manageable steps.

  1. Day 1: on site

    Our consultant visits, in person or online, for an in-depth review. We compare your current situation with the requirements of NEN 7510: physical security (access to buildings and server rooms), digital access (MFA, UZI cards, administration), procedures for incidents involving patient data, and processor agreements with suppliers.

  2. Day 2: processing

    One day offline for processing the report and preparing the action plan.

  3. Within 48 hours: report and action plan

    From insight to implementation plan within 48 hours after the site visit.

From insight to implementation plan within 48 hours.

The result of the baseline assessment is not a thick report that ends up in a drawer, but a concrete, easy-to-read action plan that forms the backbone of the follow-up process.

A concrete, easy-to-read action plan that forms the backbone of the follow-up process.

A detailed implementation plan to make your ISMS worthy of certification.

Direct input for your Statement of Applicability: the baseline assessment fills in large parts of it.

Direct evidence that your organization is actively working on information security (GDPR accountability).

Sources

The standard texts and supervisory guidance this page is based on.

Schedule your NEN 7510 Baseline Assessment: a complete picture within 48 hours.

  1. 01

    Response within one business day

    You hear from us personally, never from an autoresponder.

  2. 02

    A call with a senior specialist

    45 minutes with a consultant who knows your standard and sector. Free and without obligations.

  3. 03

    A concrete proposal

    You decide at your own pace. The engagement is concluded directly with the consultant.

Prefer direct contact? rob@auditdirect.nl +31 6 300 24 200

Tell us briefly about your healthcare organization. Your consultant schedules the assessment day and you receive the report within 48 hours of the visit.

Have you previously had experience with audits or certifications?
What steps have you taken so far toward certification?

Frequently Asked Questions about the NEN 7510 Baseline Assessment by AuditDirect

What exactly does a NEN 7510 baseline assessment involve, and how does it differ from a certification audit?

A NEN 7510 baseline assessment (also called a gap analysis or pre-audit) is an overall assessment of your current information security against the NEN 7510 standard framework. Unlike an official certification audit, which tests in a binary way whether you comply, the baseline assessment is exploratory in nature. The result is not a certificate, but a detailed implementation plan.

Is an NEN 7510 initial assessment mandatory for healthcare organizations and suppliers?

Although the baseline measurement itself is not a legal requirement, compliance with NEN 7510 often is. The Healthcare and Youth Inspectorate (IGJ) and the Dutch Data Protection Authority regard NEN 7510 as the standard for appropriate security as required in the GDPR (Article 32).

What is the relationship between the baseline assessment, the risk analysis, and the Statement of Applicability (SoA)?

The baseline assessment lays the foundation for these documents. Baseline assessment: determines what is already in place and what is missing. Risk analysis: determines the impact and likelihood of threats to the missing parts. Statement of Applicability: the required certification document; the input from the baseline assessment directly fills in large parts of it.

How much time does it take to be ready for NEN 7510 certification after an initial assessment?

The lead time depends heavily on the maturity of your current ISMS and the results of the gap analysis. Scenario A (basics in order): 3 to 6 months on average. Scenario B (start phase): 6 to 12 months.

Does the baseline assessment also provide evidence for GDPR accountability?

Yes, absolutely. The baseline measurement report serves as direct evidence that your organization is actively working on information security, which is essential in the event of any inspections by the Dutch Data Protection Authority.

Book a call now