ISO 27001, NEN 7510 and more: why one management system is the smarter choice

Every new standard feels like a new project. It doesn't have to, because you have already done most of the work.

You need ISO 27001 because a major client asks for it. A year later, a tender wants to see ISO 9001. Then the Dutch Cybersecurity Act (Cyberbeveiligingswet) comes into force and your healthcare client asks about NEN 7510. Before you know it, you are running four compliance programmes side by side. Each has its own spreadsheet, its own risk assessment and a slightly different version of the same policy.

That is not the exception. It is business as usual for growing organisations. Yet most of that work is duplicated.

The standards are more alike than you think

Put ISO 27001 and ISO 9001 side by side and you immediately recognise the same structure. Both require leadership and management commitment. Both ask for document control, internal audits, management reviews and corrective actions. That is no coincidence, because all modern ISO management system standards share the same high-level structure.

The overlap in the actual requirements is just as large. You need a risk assessment for ISO 27001, NEN 7510, NIS2 and ISO 42001. An MFA control counts for information security, but also for the GDPR and for the duty of care under the Cybersecurity Act. Awareness training comes back in almost every framework.

If you treat every standard as a separate project, you do that work again and again. Worse, the versions drift apart. The policy the ISO 27001 auditor saw is no longer the same as the policy on the table at the NEN 7510 audit.

The frameworks you come across today

The standards Dutch organisations deal with most often are:

• ISO 27001 (information security) and ISO 27701 (privacy)
• ISO 9001 (quality), ISO 14001 (environment) and ISO 45001 (occupational health and safety)
• NEN 7510 for healthcare and BIO for government
• NIS2, implemented in the Netherlands through the Cybersecurity Act
• AVG/GDPR
• ISO 42001 for AI management systems
• SOC 2 for organisations with American clients

On top of that, clients, investors and industry bodies increasingly set their own requirements. These are not official standards, but you still have to show that you comply with them.

Stop duplicating work and use the overlap between standards

An integrated management system revolves around one principle: you set up a control once and link it to every requirement it meets. The evidence you collect, such as an MFA report, a training record or the minutes of a management review, then counts for every standard where it is relevant.

That saves more than you might expect. In our experience, organisations that add a second standard within the same system save 30 to 40% of the implementation effort compared with a separate programme. The biggest benefit often lies in consistency: one version of the truth, and that is the version you show every auditor.

A new version of a standard is not a fresh start

Standards change. With the transition to ISO 27001:2022, many organisations had to go through their entire control set again, including the parts that had not changed. If you manage your standards in one system, you only need to look at what is actually new. The rest stays in place.

How ISOPlanner™ handles this

ISOPlanner™ supports more than 40 frameworks in one environment, and you can add your own frameworks too. Overlap is handled automatically: one control meets requirements from several standards at once, and evidence is visible everywhere it counts. When a new version of a standard comes out, everything that has not changed is carried over automatically. Subsidiaries or locations each get their own set of standards, within the same system. Because the platform runs in Microsoft 365, your team simply works from SharePoint, Teams and Outlook.

‍