How can ManageEngine support healthcare organizations in meeting this standard?
With ManageEngine Log360 (SIEM), hospitals, GP practices, pharmacies, long-term and mental health care providers, health insurers, and healthcare ICT suppliers can start aligning with the requirements of NEN 7510. See the key controls and how our solution helps in the table below.
A.5A.5 Organisational controls
| Clause | Functionality | Explanation |
|---|---|---|
| A.5.7 Threat intelligence: Information relating to information security threats shall be collected and analysed to produce threat intelligence. | Log360 - Threat intelligence feeds, IoC/IP/URL/domain reputation, dark web monitoring, MITRE ATT&CK®-mapped detections. | Log360 collects and correlates threat data from threat intelligence feeds with IoCs and reputation scores for IPs, URLs, and domains, supplemented by dark web monitoring. The data is linked to network events and mapped to MITRE ATT&CK to produce actionable threat intelligence. |
| A.5.9 Inventory of information and other associated assets: An inventory of information and other associated assets shall be developed and maintained; healthcare-specific: all information flows (within and between organisations) and their interfaces, including integration platforms, shall be included. | Log360 - Asset/device discovery, log source inventory, sensitive data discovery and classification. | Log360 discovers and inventories devices and log sources across the network and locates and classifies where sensitive data (PII/ePHI) resides, covering the inventory of information assets. The healthcare-specific requirement to record all information flows and their interfaces, including integration platforms, falls outside the suite; the organisation must supplement this with its own process-level inventory of interfaces and integration platforms. |
| A.5.12 Classification of information: Information shall be classified according to confidentiality, integrity and availability needs; healthcare-specific: personal health information shall be classified uniformly as confidential. | Log360 - Automated/manual file classification (public/internal/sensitive/restricted), PII/ePHI discovery. | Log360 classifies files into categories such as public, internal, sensitive, and restricted, based on content and vulnerability, and identifies ePHI through predefined discovery policies. This enables personal health information to be tagged uniformly as confidential, as the healthcare-specific control requires. |
| A.5.13 Labelling of information: An appropriate set of procedures shall be developed and implemented to label information in accordance with the classification scheme. | Log360 - Automated and manual file tagging, content-aware classification labels. | Log360 applies classification labels through automated and manual tagging in line with the organisation's classification scheme. The applied labels then drive content-aware protection measures. |
| A.5.14 Information transfer: Information transfer rules, procedures or agreements shall be in place for all types of communication facilities; healthcare-specific: these shall be established before any transfer takes place. | Log360 - file transfer/file copy monitoring, USB/email/printer transfer auditing and blocking, DLP policies, data exfiltration detection. | Log360 monitors, audits, and blocks the transfer of sensitive data via USB, email, and printers, and detects anomalous data exfiltration, covering the technical control of information transfer. Establishing the rules, procedures, and agreements before any transfer takes place is the organisational/contractual part of this control and must be defined by the organisation. |
| A.5.15 Access control: Rules to control physical and logical access shall be established and implemented; healthcare-specific: role-based access control shall apply to access to personal health information. | Log360 - Logical access monitoring. | Log360 monitors logical access events, including access to personal health information subject to role-based access control. The physical access control that this clause also covers falls outside Log360 and must be addressed with physical measures. |
| A.5.19 Information security in supplier relationships: Processes shall be established to manage information security risks associated with the use of supplier products or services; healthcare-specific: risks of external-party access to systems or the data they contain shall be assessed and controlled. | Log360 - Third-party and remote access monitoring. | Log360 monitors the activity of external and remote access, covering the healthcare-specific requirement to monitor external-party access to systems and data. Log360 cannot assess the broader supplier risks and set contractual arrangements. |
| A.5.23 Information security for use of cloud services: Processes for acquiring, using, managing and exiting cloud services shall be established in line with information security requirements. | Log360 - Cloud security monitoring (AWS, Azure, GCP, Salesforce), integrated CASB. | Log360 monitors cloud platforms such as AWS, Azure, GCP, and Salesforce and includes an integrated CASB for visibility into and control over cloud usage. Establishing the processes for acquiring and terminating cloud services is procedural and must be set up by the organisation. |
| A.5.24 Planning and preparation for managing information security incidents: The organisation shall define, establish and communicate processes, roles and responsibilities for incident management. | Log360 - Incident management, SOAR playbooks, centralized incident investigation, correlation rules, alert profiles. | Log360 provides the technical foundation for incident management with automated SOAR playbooks, centralized incident investigation, and predefined correlation and alert profiles. Formally defining and communicating roles and responsibilities for incident management is a task the organisation undertakes itself. |
| A.5.25 Assessment and decision on information security events: The organisation shall assess events and decide whether they are categorised as information security incidents. | Log360 - Event correlation, alert prioritization, UEBA risk scoring, automated TDIR, GenAI-driven summaries. | Log360 assesses events through correlation, UEBA risk scoring, and prioritization in its automated threat detection, investigation, and response (TDIR) engine, so it can be decided whether an event is classified as an incident. GenAI-driven summaries condense logs and alerts into readable form to support triage. |
| A.5.26 Response to information security incidents: Information security incidents shall be responded to in accordance with documented procedures. | Log360 - 50+ SOAR playbooks, automated incident response workflows, ITSM integration, centralized incident investigation. | Log360 responds to incidents with predefined SOAR playbooks and automated response workflows executed on detection to contain attacks. ITSM integration automates case management so that responses follow documented procedures. |
| A.5.27 Learning from information security incidents: Knowledge gained from incidents shall be used to strengthen and improve information security controls. | Log360 - Incident and user timelines, process lineage visuals, MITRE ATT&CK mapping, audit reports. | Log360 reconstructs incident and user timelines and process relationships, and maps events to MITRE ATT&CK, so that lessons learned can be used to strengthen detection and controls. The reporting supports post-incident evaluation. |
| A.5.28 Collection of evidence: The organisation shall establish procedures for the identification, collection, acquisition and preservation of evidence relating to information security events. | Log360 - Tamper-evident log retention, searchable archive, forensic analysis, long-term audit data archival (3, 5, or 7 years). | Log360 retains logs in a searchable, protected archive over long retention periods (3, 5 or 7 years) and supports forensic analysis, so that evidence relating to security events can be identified, collected, and preserved. The formal chain-of-custody procedures must be defined organisationally. |
| A.5.29 Information security during disruption: The organisation shall plan to maintain information security at an appropriate level during a disruption. | Log360 - Continuous monitoring during disruption. | Log360 continues to monitor during a disruption. Planning the appropriate security level during disruptions is largely a continuity process; Log360 covers monitoring, not the broader continuity planning. |
| A.5.31 Legal, statutory, regulatory and contractual requirements: Requirements relevant to information security and the organisation's approach to meeting them shall be identified, documented and kept up to date. | Log360 - 30+ prebuilt compliance audit templates, real-time violation alerts, custom report profiles. | Log360 provides prebuilt compliance reporting templates and real-time violation alerts that allow compliance with regulatory requirements to be demonstrated and monitored. Identifying and keeping current the applicable legal requirements themselves is a legal/organisational process the organisation performs. |
| A.5.33 Protection of records: Records shall be protected from loss, destruction, falsification, unauthorized access and unauthorized release. | Log360 - Protected, tamper-evident log archive, retention, file integrity monitoring, access auditing, detection of security log tampering and deletion. | Log360 protects records through a secure, searchable archive with log retention, monitors file integrity and access, and detects clearing of security logs, helping to detect loss, falsification, or unauthorized access to records. |
| A.5.34 Privacy and protection of personal data: The organisation shall identify and meet the requirements for privacy and protection of personal data under applicable law. | Log360 - PII/ePHI discovery and classification, content-aware DLP, data security monitoring, compliance reporting. | Log360 discovers and classifies PII and ePHI, enforces content-aware protection policies, and monitors access to and use of personal data with compliance reporting, enabling privacy requirements to be met technically. Legally establishing the requirements under applicable law remains an organisational responsibility. |
| A.5.36 Compliance with policies, rules and standards for information security: Compliance with policies, rules and standards shall be regularly reviewed. | Log360 - Compliance monitoring, policy violation alerts, configuration and activity audit reports. | Log360 monitors compliance with security policies through violation alerts along with compliance and audit reports on configurations and user activity. The periodic review itself and the drafting of the policy remain organisational tasks. |
| A.5.43 HLT – External incident reporting: Information security incidents shall be reported in accordance with legal, contractual or regulatory obligations. | Log360 - Incident reporting, compliance report generation, real-time alerting. | Log360 generates incident and compliance reports along with real-time alerts that provide the data needed for mandatory external reporting of incidents. Submitting reports to regulators within the statutory deadlines is a process obligation the organisation performs itself. |
A.6A.6 People controls
| Clause | Functionality | Explanation |
|---|---|---|
| A.6.7 Remote working: Security measures shall be implemented when personnel work remotely to protect information accessed, processed or stored outside the organisation's premises. | Log360 - Remote access monitoring. | Log360 monitors remote access events for anomalous behaviour. Log360 does not cover physical security of the remote workplace. |
| A.6.8 Information security event reporting: The organisation shall provide a mechanism for personnel to report observed or suspected information security events in a timely manner. | Log360 - Real-time alerting, automated event detection and notification, alert profiles. | Log360 detects security events and sends real-time alerts via email and SMS to the appropriate channels, supporting timely flagging of events. The mechanism for personnel to manually report suspicions (such as a reporting point or form) is procedural and must be set up by the organisation. |
A.7A.7 Physical controls
| Clause | Functionality | Explanation |
|---|---|---|
| A.7.10 Storage media: Storage media shall be managed throughout their lifecycle; healthcare-specific: all personal health information stored on removable media shall be encrypted. | Log360 - Removable media/USB auditing and control, read-only/block policies. | Log360 audits and controls the use of removable media and can block or set read-only, write, or copy actions to USB. Log360 cannot meet the healthcare-specific requirement that all personal health information on removable media be encrypted; media encryption must be addressed with a separate encryption solution. ManageEngine handles media and device encryption across its security and endpoint suites through ManageEngine Device Control Plus for USB/removable storage and Mobile Device Manager Plus for mobile media and devices |
A.8A.8 Technological controls
| Clause | Functionality | Explanation |
|---|---|---|
| A.8.1 User endpoint devices: Information stored on, processed by or accessible via user endpoint devices shall be protected. | Log360 - Endpoint data protection, file activity and removable-device monitoring on endpoints. | Log360 protects information on endpoints by monitoring and controlling file activity, copy actions, and the use of removable devices. Full endpoint management such as patching and configuration must be addressed separately using another tool called ManageEngine Endpoint Central. |
| A.8.2 Privileged access rights: The allocation and use of privileged access rights shall be restricted and managed. | Log360 - Privileged user activity monitoring. | Log360 monitors privileged user activity, supporting the control and oversight of the assignment and use of special rights. |
| A.8.3 Information access restriction: Access to information and other associated assets shall be restricted in accordance with the topic-specific access control policy. | Log360 - Access monitoring. | Log360 monitors the access events for compliance with the topic-specific access control policy. |
| A.8.7 Protection against malware: Protection against malware shall be implemented and supported by appropriate user awareness. | Log360 - Malware/ransomware detection via the correlation engine, threat intel and UEBA, ransomware detection and quarantine. | Log360 detects malware and suspicious software installations through the correlation engine, threat intelligence, and UEBA, and detects and quarantines ransomware at the file level. Preventive endpoint antivirus itself is not part of the suite and must be supplemented with an AV/EDR solution; Log360 provides the detection and response layer. |
| A.8.8 Management of technical vulnerabilities: Information about technical vulnerabilities shall be obtained, exposure evaluated and appropriate measures taken. | Log360 - Security and risk posture management, misconfiguration/attack-surface detection (AD, Microsoft SQL), attack surface analysis. | Log360 assesses the security posture and flags misconfigurations and attack-surface exposure in Active Directory, Microsoft SQL, and other databases and its attack surface analysis detects AD attacks and risky configurations. A full vulnerability scanner with patch management falls outside the suite and must be addressed separately using ManageEngine Patch Manager Plus |
| A.8.9 Configuration management: Configurations, including security configurations, shall be established, documented, implemented, monitored and reviewed. | Log360 - Configuration change auditing for AD, GPO, schema, DNS (200+ event reports); security configuration monitoring. | Log360 records and reports configuration changes for AD objects, GPOs, schemas, and DNSs and monitors security configurations. This ensures configurations are monitored and reviewed; documenting the baseline configuration remains an organisational task. |
| A.8.10 Information deletion: Information stored in information systems, devices or other storage media shall be deleted when no longer required. | Log360 - Redundant, obsolete, trivial (ROT) data identification, file analysis. | Log360 identifies ROT data and analyses files, helping to determine which information is no longer required. Log360 does not securely delete or overwrite data and media and must be addressed with a separate erasure/sanitization solution such as ManageEngine Endpoint Central. |
| A.8.12 Data leakage prevention: Data leakage prevention measures shall be applied to systems, networks and devices that process, store or transmit sensitive information. | Log360 - DLP policies; USB, email, printer data leak prevention; file copy blocking; data exfiltration anomaly detection. | Log360 prevents data leakage with DLP policies that detect and block transfer via USB, email, and printers; stop copy actions; and detect data exfiltration through AI-driven anomaly detection. This covers data leakage prevention across endpoints, networks, and file servers. |
| A.8.15 Logging: Logs of activities, exceptions, faults and other relevant events shall be produced, stored, protected and analysed. | Log360 - Centralized log collection and parsing (750+ parsers); tamper-evident storage; retention; search; logon, logoff, and activity audit logs. | Log360 produces, collects, parses, stores, and searches log files of events, exceptions, and errors centrally, with protected storage and retention, and provides detailed logging of logon, logoff, and user activity. The logs are analysed through correlation and dashboards. |
| A.8.16 Monitoring activities: Networks, systems and applications shall be monitored for anomalous behaviour and measures taken to evaluate potential incidents. | Log360 - Real-time security analytics, UEBA anomaly detection, correlation engine, 2,000+ built-in MITRE-mapped detection rules, alerting. | Log360 monitors networks, systems, and applications for anomalous behaviour with real-time security analytics, a correlation engine, and ML-driven UEBA, and generates alerts to evaluate potential incidents. Dynamic peer grouping and risk scores refine the detection of anomalies. |
| A.8.18 Use of privileged utility programs: The use of utility programs capable of overriding system and application controls shall be restricted and tightly controlled. | Log360 - Monitoring of privileged utility and process execution. | Log360 monitors the execution of processes and system utilities and flags the use of tools that can bypass controls. Blocking specific utility programs (application control) largely falls outside Log360 and must be addressed separately with ManageEngine Endpoint Central. |
| A.8.19 Installation of software on operational systems: Procedures and measures shall be implemented to securely manage the installation of software on operational systems. | Log360 - Software installation detection, auditing, monitoring, and alerting. | Log360 detects and reports software installations on systems and can alert on them. Enforcing which software may be installed (application allowlisting) is not provided by the suite and must be addressed with endpoint/application control such as ManageEngine Endpoint Central. |
| A.8.20 Networks security: Networks and network devices shall be secured, managed and controlled to protect information. | Log360 - Network device log collection and monitoring (firewalls, routers, switches), alerting. | Log360 collects and monitors logs from network devices such as firewalls, routers, and switches, and generates alerts on suspicious network activity. Configuration and hardening of the network devices themselves falls outside the suite; Log360 provides the monitoring and detection layer. |
| A.8.23 Web filtering: Access to external websites shall be managed to reduce exposure to malicious content. | Log360 - Web traffic monitoring and content/application control, integrated CASB, cloud access monitoring. | Log360 monitors web traffic and restricts unwanted or risky web content and applications, and its integrated CASB provides visibility into and control over cloud access. This allows access to external websites to be managed to limit exposure to malicious content. |
| A.8.32 Change management: Changes to information processing facilities and information systems shall be subject to change management procedures. | Log360 - Change auditing for AD, GPOs, files, and systems; change monitoring and alerting. | Log360 detects, reports on, and alerts about changes to information systems and facilities such as AD, GPOs, files, and configurations. The formal change management procedure (request, approval, test) is procedural; the suite provides the detection and verification of implemented changes. |
| A.8.35 HLT – Zero Trust principles: Groups assigned to a network segment shall be kept as small as possible and may only access another segment after both segments have mutually authenticated. | Log360 - Continuous monitoring, UEBA. | Log360 supports Zero Trust principles with continuous monitoring and behavioural analytics. The actual network segmentation and mutual authentication between segments are network architecture measures that fall outside Log360 and must be addressed with network/microsegmentation software such as ManageEngine OpUtils. |
Conclusion
Now that you've explored how NEN 7510 shapes information security across the Dutch healthcare chain and how Log360 helps you address its controls, it's time to take the next step.
Whether it's identity governance, access control over patient information systems, NEN 7513-compliant logging of who accessed which record, threat detection, or building an audit trail you can put in front of the IGJ, we're here to guide you through it. Start a 30-day, free trial to experience our solutions in your own environment, or contact us to schedule a one-on-one consultation.
Disclaimer: The information provided on this page is for general knowledge and awareness purposes only. It is not intended to serve as professional, legal, or regulatory advice. Compliance with NEN 7510 depends on your organization's specific environment, processes, and risk profile, including the scope of your information security management system, the results of your risk assessment, and the choices recorded in your Statement of Applicability.
To accurately assess your compliance posture, we strongly recommend engaging a qualified consultant, certification body, or referring directly to the official standards published by NEN (NEN 7510-1:2024 and NEN 7510-2:2024, together with NEN 7512 and NEN 7513) on nen.nl, and to the guidance published by the Inspectie Gezondheidszorg en Jeugd on igj.nl. Under an agreement between NEN and the Ministry of Volksgezondheid, Welzijn en Sport, these standards are available at no cost to healthcare institutions