Under the Dutch implementation of NIS2, healthcare organisations have to show that their security measures meet NEN 7510, the Dutch information security standard for the sector. The standard itself is familiar. The scope is not: it now covers every network and information system, not just the clinical ones.
For a lot of Dutch hospitals, mental health trusts and care providers, that means their information security management system (ISMS) has to grow well beyond the electronic patient record.
What the new healthcare regulation says
The Netherlands transposed NIS2 through the Cyberbeveiligingswet (Cbw, the Dutch Cybersecurity Act), which took effect on 15 August 2026. The day before, the health ministry published the Cyberbeveiligingsregeling voor de zorg in the Government Gazette. It sets out how the act applies to healthcare and to manufacturers of medical devices and in vitro diagnostic devices.
Article 2.1 is the one that matters. The risk management measures the act requires must demonstrably meet NEN 7510. Alternatively, an organisation can use ISO/IEC 27001 and 27002, or show an equivalent level of protection. Supervision sits with the Inspectie Gezondheidszorg en Jeugd (IGJ), the Dutch health and youth care inspectorate.
Small organisations are generally out of scope. The explanatory notes put the line at fewer than 50 FTE and annual turnover or a balance sheet total under €10 million. Organisations in scope also have to register with the national cyber security centre (NCSC).
Wasn't NEN 7510 already mandatory?
It was, for a narrower set of systems. Dutch law on patient data exchange (the Wabvpz) has long pointed to NEN 7510 through a decree on electronic data processing by care providers. That obligation covers how organisations manage, secure and use their healthcare information systems.
The explanatory notes to the new regulation spell out the gap. The old duty applies to exchange systems and healthcare information systems. The duty of care under the Cbw applies to all network and information systems, and the notes give the HR system as an example.
Most providers built their ISMS around the patient record and the links to partners in the care chain. In my view the rostering system, finance, telephony and building management now belong in the same risk assessment, each with controls you can evidence.
No certificate required, but you do need proof
Certification is not a requirement. The notes say a certificate shows compliance with the standard but is not mandatory. What you do need is evidence you can hand over when the IGJ asks.
I would set a high bar for "demonstrably". A policy document proves little on its own. A risk assessment per system, a statement of applicability, audit reports and minutes showing management took decisions are the kind of thing that holds up. A certificate with a narrow scope only gets you part of the way: it shows the ISMS works for the patient record, not that the HR environment is protected.
Two deadlines landing together
There is a second clock running. NEN 7510 was revised, and the 2024 edition was published on 16 December 2024. Existing certificates have to be transitioned to NEN 7510:2024 by 20 February 2027.
Certified organisations therefore face two pieces of work in the same window: widening the scope for the Cbw and completing the move to the new edition. Run them as one programme and they fit together reasonably well. Part 2 of NEN 7510 includes an annex mapping its controls to the NIS2 requirements, which is a sensible place to start a gap analysis.
I expect experienced NEN 7510 specialists to be in short supply over the coming months. Every provider in scope is looking at the same kind of work, many of them against the same February deadline.
Which profile to bring in first
My view is that the first hire should be on governance and information security, not monitoring. When new legislation lands, plenty of organisations reach for another SOC analyst or a more expensive detection tool. That has its uses, but it does not answer the inspectorate's question, which is whether a working management system covers the whole organisation.
For this catch-up, three roles keep coming up:
- A NEN 7510 specialist or ISMS implementer to redraw the scope, run the risk assessments for the newly included systems and handle the move to the 2024 edition.
- A security officer or CISO who can bring the board along, explaining the residual risk on those systems clearly enough for the board to make a deliberate decision on it.
- A GRC specialist to keep the evidence in order: who decided what, which controls work and where the exceptions are.
The first of these is usually temporary. Setting things up takes a few months of intensive work, after which the in-house team can maintain it. An interim specialist with healthcare experience is a natural fit. Someone who has already widened a NEN 7510 scope in a hospital knows where the resistance will come from and which departments to involve early. For a wider look at NIS2 roles, see which talent you need to demonstrate NIS2 compliance.
Incident reporting still applies
The regulation also sets thresholds for when a cyber incident counts as significant and has to be reported. Z-CERT, the sector's computer emergency response team, carries out the CSIRT tasks for Dutch healthcare. Its formal designation was still pending in August, awaiting advice from the Netherlands Court of Audit, but Z-CERT continues to support organisations in the meantime. Check your reporting procedure and contact details before you need them. For the first days of an incident, see incident response retainer or interim DFIR specialist.
Need help with the catch-up?
We place interim and permanent security professionals with healthcare organisations, from NEN 7510 specialists to CISOs. Our pages on cybersecurity in healthcare and GRC and compliance show the profiles we work with.
Want to know who is available now for a NEN 7510 programme? Call or email me through the contact page.
