Skip to content
IT-Checklist

Standards & regulations: checklist and advice

Last updated: · IT-Checklist editorial team · All changes

More and more customers, insurers and tenders ask you to prove your information security. Sometimes that means a certificate such as ISO 27001 or NEN 7510. Sometimes it is a legal duty, such as DORA for the financial sector or the Cyber Resilience Act for makers of software and smart products.

This topic helps you work out which rules apply to you. And whether you have the basics to prove it: a policy, an owner, regular review and stored evidence.

Check where your business stands on standards & regulations

The free IT check asks you these questions. Then you see your score per topic and advice for every gap. You don't need an account.

Start the IT check →

Why this matters

Certificates against the old ISO/IEC 27001:2013 standard have not been valid since 31 October 2025. If you missed that, you may suddenly have no valid certificate during a customer audit or tender.

Under the Cyber Resilience Act, the duty to report actively exploited vulnerabilities in products with digital elements has applied since 11 September 2026. If you sell software or smart devices, you must be able to make those reports.

The 11 questions in this topic, with advice

Each question describes the situation you want to have. The label shows how much the measure weighs in your score. 'Do first' counts the most.

  1. We work on information security in a structured way, for example following the ISO 27001 standard (policy, risk analysis, measures, periodic review).

    Important

    You don't need to be certified right away: use ISO 27001 as a framework. Start with a short security policy, a risk analysis and an annual review.

    Applies to: SMEs, larger companies

  2. Our ISO 27001 certification (if any) has been updated to the current 2022 version of the standard.

    Important

    Certificates against the old ISO/IEC 27001:2013 standard are no longer valid since 31 October 2025. If you are certified, check with your certification body that you are on the 2022 version.

    Applies to: SMEs, larger companies

  3. Our security measures are tested periodically, for example with an internal review, audit or penetration test.

    Recommended

    Schedule at least an annual review: go through your measures, have an external scan or penetration test performed and follow up on the findings.

    Applies to: SMEs, larger companies

  4. We know which sector-specific rules apply to us, such as DORA (financial), healthcare security standards or PCI DSS (card payments).

    Recommended

    Besides NIS2 and the GDPR, sectors have their own requirements: DORA for financial services, healthcare security standards, PCI DSS for card payments. Ask your industry association what applies to you.

  5. Our information security agreements and responsibilities are written down in a short, current policy that employees know.

    Recommended

    A security policy does not need to be a tome: one or two pages with the key agreements and who is responsible for what. Discuss it at onboarding and annually.

    Applies to: SMEs, larger companies

  6. We keep evidence of our measures (settings, trainings, tests), so we can demonstrate what we do during audits or incidents.

    Recommended

    Document what you do: screenshots of settings, training attendance lists, test reports. Under NIS2 and the GDPR you must be able to demonstrate measures — and your insurer will ask for them too.

  7. We keep track of new IT and security legislation, for example via an industry association, newsletter or advisor.

    Recommended

    Legislation changes fast (NIS2, AI Act, ISO updates). Subscribe to a newsletter from a trusted source such as your national cyber security centre — free and aimed at businesses.

  8. We log important events in our systems (login attempts, changes, error messages) and periodically review these logs for anomalies.

    Important

    Enable logging on your key systems (server, firewall, cloud environment) and agree who reviews the logs once a month for anything unusual.

  9. We have a concrete cloud security policy that documents who may set up a new cloud service, where the data may be stored and who has access to it.

    Important

    Write half a page of cloud rules: only the person responsible for IT sets up new services, data stays within the EU unless otherwise agreed, and access is tracked per service.

  10. One person is designated as responsible for GDPR and (where applicable) NIS2 compliance within our business.

    Recommended

    Compliance without an owner fades away. Appoint someone as the point of contact (this can be the owner) who keeps an overview of obligations, notifications and documentation.

  11. If we work in healthcare and hold NEN 7510 certification, it has been updated (or will be updated by 20 February 2027 at the latest) to the NEN 7510:2024 version of the standard.

    Recommended

    Healthcare organisations must have transitioned to NEN 7510:2024 by 20 February 2027 at the latest. If you are certified, schedule the transition audit with your certification body in good time.

Where to start

  • List on one page which standards and laws apply to your sector. Add who in the business is responsible for them.
  • Write a short information security policy that staff actually read. What are the agreements and who can they go to?
  • Keep evidence of what you do. For example screenshots of settings, training attendance lists and test results.
  • Working in Dutch healthcare with a NEN 7510 certificate? Plan the move to NEN 7510:2024 before 20 February 2027.

Common mistakes

  • Getting a certificate and then leaving the policy in a drawer until the next audit.
  • Turning on logging and never looking at the logs. A break-in can then go unnoticed for months.
  • Assuming rules such as DORA or the CRA only apply to large companies. Suppliers get requirements too.

Official sources

Read next

All topics in the checklist