ISO 27001 / BIO / NEN 7510
- information security: increasingly in demand -

Information security, what is it all about? Whereas ISO 9001 is all about the quality requirements of customers and other stakeholders, ISO 27001 is about the requirements that must be set for information security. The ever-increasing attention to information security, the obligation to report data leaks, means that the ISO 27001 standard is increasingly in demand.

ISO 27000 is an international standard (actually a family of standards) that sets out requirements for a management system to control information security. The ISMS (Information Security Management System) is the pivot in the management of information security. The standard specifies the establishment, implementation, execution, control, assessment, maintenance and improvement of this management system.

BIO is a recent baseline information security for the government. It replaces previous baselines for municipalities, central government, water boards and provinces. The baseline is an elaboration of the ISO 27001 family of standards, specifically ISO 27001:2013.

For the healthcare sector in the Netherlands, there is the NEN 7510 standard for information security. This standard was developed by the Netherlands Standardization Institute and is therefore nationally focused. The standard is based on the Code for Information Security. NEN 7510 provides healthcare institutions with a guideline for formulating, recording and checking internal information security. In fact, NEN 7510 is a compilation of about 150 paragraphs (divided into 11 chapters) in which all kinds of matters that affect information security are described. The implementation is again described in an ISMS.

With the ISMS, there must be a demonstrable control in the field of information security within the own organization. It covers a wide range of areas, such as: physical security, in-house and external personnel, business continuity, access policy, incident management, development and maintenance of information systems and much more. The focus is on reducing the risk to an acceptable level. This acceptable level of risk must be classified with regard to the availability, integrity and confidentiality of the data.

An ISMS is easy to set up with the Proware management system: HLS structure, labelling with standard items, integrated risk management, etc. There are examples of various ISO 27001 - certified customers.
For substantive questions or support for a ISO27001 / NEN7510 certification process, we refer to our colleagues at Meta-audit. The list of mandatory documents is interesting.

 

Oeps ...  this document is only available in Dutch. Please use the language button on top.