NEN 7510-2 amended in 2026: what does this mean for you?

‍

Even so, it pays to know what has changed in NEN 7510-2, because your auditor may ask about it during your next audit. Below we list the changes and, for each one, what you can do about it now.

What is NEN 7510-2 again?

NEN 7510 consists of two parts. NEN 7510-1 contains the requirements for your management system, such as the clauses on context, leadership, planning and improvement that you know from ISO 27001. NEN 7510-2 contains the controls themselves, with the healthcare-specific additions to the controls in Annex A. Think of requirements for access to patient data, incident reporting and staff training.

The update follows the 2025 revision of ISO 27799, the international standard on which NEN 7510-2 is based. Officially, the change is an amendment to the 2024 version, which is why it is called NEN 7510-2:2024+A1:2026. No new controls have been added. Eight existing healthcare-specific guidelines have been tightened or clarified.

What has changed in NEN 7510-2 (A1:2026)?

Two of the eight amended guidelines have only been reworded. The other six have consequences for your ISMS (your information security management system).

‍

• A.5.12 Classification of personal health information: addition, with extra attention to genetic and biometric data.
• A.5.15 Role-based access policy: text restructured, no new requirement.
• A.5.16 Identity management: further explanation of "professional competencies", which you need to verify when registering users.
• A.5.30 ICT continuity in healthcare: tightened, because emergency procedures belong in the continuity plan.
• A.5.34 Restricting access to health information: examples expanded, no new requirement.
• A.6.3 Awareness, education and training: the explicit attention to social engineering is new.
• A.6.8 Reporting security events: it is new that reporting must be easy and, if preferred, anonymous.
• A.6.9 Training for management: it is new that crisis simulations are a mandatory part of the training.

‍

There are also a few smaller changes. Throughout the standard, the Dutch term "directie" (board) has been replaced by "topmanagement" (top management), and the layout has been converted from tables to running text. The informative annexes C, D and E have also been updated. In Annex E, the standard now refers to the Cybersecurity Act and the Cybersecurity Decree, where it used to refer to NIS2.

Which changes require action?

‍

1. Social engineering in your awareness training (§6.3)

The standard now explicitly states that healthcare workers are a target of social engineering. Think of someone on the phone pretending to be a fellow healthcare provider, a relative of a patient or an employee of the police or a school. Your awareness training needs to cover this, and employees need to know how to report such an attempt.

‍

2. Reporting incidents without fear (§6.8)

Organizations must encourage early reporting of incidents, without employees having to fear being blamed. The standard even asks you to consider an anonymous reporting option, with technical safeguards that protect the identity of the person reporting.

‍

Do employees currently hesitate to report a mistake? Then this is a good moment to take a close look at your reporting process. You can use our incident reporting procedure as a guide.

‍

3. Crisis simulations for management (§6.9)

Management training must now include crisis simulations that focus on cyber incidents such as a ransomware attack or a data breach. An annual presentation on information security is therefore no longer enough. Think of a tabletop exercise, in which management sits down to work through a simulated crisis and has to make real decisions.

‍

4. Verifying professional competencies (§5.16)

In healthcare, identity management goes further than a username and a password. If your organization gives a healthcare provider access to health information, you need to verify their professional competencies with a relevant registration body, such as the BIG register (the Dutch register of healthcare professionals) or another professional register. Digital certificates (such as the UZI card) can help with this.

‍

In practice, this means HR and access management need to be closely aligned. Record who checks the registration, at what point and how you keep track of it, so you can show this during the audit.

‍

5. Emergency procedures in your continuity plan (§5.30)

Emergency procedures now need to be an actual part of your continuity plan. A plan that only "takes them into account" is no longer sufficient.

‍

6. Genetic and biometric data (§5.12)

When classifying health information, the standard asks for extra attention to genetic and biometric data. Does your organization process this kind of data? Then check whether it has its own place in your classification scheme.

When do you need to move to NEN 7510:2024?

Apart from this update, there is another deadline to keep in mind. If you have a certificate based on NEN 7510:2017, the transition to NEN 7510:2024 must be completed by February 20, 2027. Many healthcare organizations are planning their transition audit in the same period, so it is wise to arrange it with your certification body now. With our mapping for the transition to NEN 7510:2024, you can quickly see what changes for your organization. The mapping is currently available in Dutch only.

What can you do now?

• Compare your awareness training with the social engineering examples in the standard and add what is missing.
• Take a critical look at your incident reporting process and consider an anonymous reporting route.
• Plan a crisis simulation for your management, with a concrete scenario such as ransomware.
• Check whether you verify professional registration when creating accounts, and record how you do this.
• Check whether your emergency procedures are actually included in your continuity plan.
• Use "top management" instead of "board" in your policy documents, so your terminology matches the standard.
• Are you still working with NEN 7510:2017? Then plan your transition to the 2024 version.

‍

Would you like to work through this step by step? We have updated our NEN 7510 checklist and the NEN 7510 mapping to the new version of NEN 7510-2, so you can see for each change where your ISMS already complies. Both documents are currently available in Dutch only.

Frequently asked questions about the NEN 7510-2 amendment

Do I need to apply for my NEN 7510 certificate again?

No, your certificate remains valid. Certification takes place against NEN 7510-1, and that standard has not changed.

Have any new controls been added?

No, there are no new controls. Eight existing healthcare-specific guidelines have been tightened or clarified.

When does the new version of NEN 7510-2 apply?

The amended version has applied since March 27, 2026. Its official name is NEN 7510-2:2024+A1:2026, because it is an amendment to the 2024 version.

Can an auditor ask me about this?

Yes, auditors can ask during your audit how you apply NEN 7510-2, even though your certificate is formally assessed against NEN 7510-1.

When do I need to move to NEN 7510:2024?

If you still have a certificate based on NEN 7510:2017, the transition must be completed by February 20, 2027.

Need help with the changes in NEN 7510-2?

Every healthcare organization has its own starting point, so what these changes mean for you depends on your situation. Would you like to know where your organization stands? Schedule a no-obligation consultation below, and we will look together at what is needed.