Ready for your ISO 27001 or NEN 7510 audit

A client asks whether you have ISO 27001. Or a healthcare organization wants to know how you handle NEN 7510 before it signs with you. You search a shared folder and find a security policy from three years ago, written by someone who no longer works there. The technology is probably better than the document suggests, but you cannot show it. That gap between what you do and what you can prove is exactly what we close.

What the standard really requires

ISO 27001 is not a list of products you have to buy. It is a way of working: you decide which information matters, what can go wrong, which controls you put in place against that, and how you check that those controls work. The standard does not prescribe a firewall brand. It asks whether you made a reasoned choice and whether you review that choice regularly.

That means a thick manual will not save you. An auditor looks at practice. Who has access to the client database, and does that still match last year's list? What happens when a laptop disappears? When did you last test whether a backup actually comes back? So we start with your systems, not with a word processor.

NEN 7510 in healthcare

If you work with patient data, NEN 7510 is the Dutch standard that goes with it. Its structure closely resembles ISO 27001, but it adds requirements specific to healthcare information: who may view a record, how you log that, and how you show afterward who looked at it and when. For an out-of-hours GP service, a mental health practice, or a vendor that supplies software to healthcare, that is the part that takes the most time.

In practice, we implement the two standards in one pass. The controls overlap for the most part, so there is no point in running two separate projects. We track which control belongs to which standard, so at an audit you can point to exactly where the evidence is. Data stays within the EU, in our managed environments.

Technology that produces evidence

The biggest difference between a painful audit and a smooth one is where the evidence comes from. If someone has to spend a week taking screenshots and updating lists, you know it will happen again next year. We make sure your systems produce the evidence themselves. Access rights come from one central source, logs are kept and searchable, backups report whether they succeeded, and a restore is tested periodically instead of assumed.

Monitoring runs continuously, with an agreed escalation when something goes wrong. To check whether the controls actually hold, we often combine this with a Penetration test: it shows what an attacker can really do, and its findings feed straight into your risk analysis.

From setup to audit

We implement, repair, and document, so the independent auditor you choose sees something working behind every control. If a control costs more than it delivers for your organization, we tell you so directly instead of quietly adding it anyway.

If you use AI in your processes, the EU AI Act comes on top as a separate layer. We include those requirements in the same inventory, so you do not start over in a year. The work starts with a free intake in which we look at how far along you already are. Often more is in order than you thought, and what is mainly missing is the documentation. You can leave the management afterward to us or handle it yourself. The records are yours, like everything else we build for you.