Newblend Book an introduction
Information security

IT audits

Newblend audits your information security against NIS2, ISO 27001 and NEN 7510. We have our own in-house auditor, so you do not need an external firm to know where you stand. An audit does not produce a certificate — only an accredited body issues those — but it does give you the insight and evidence to obtain and keep that certification.

In short
  • Newblend carries out internal information security audits, focused on NIS2, ISO 27001 and NEN 7510.
  • The audits are carried out by our own auditor and can be performed independently.
  • We do not certify. A certificate comes from an accredited certification body.
  • The internal audit is mandatory under ISO 27001 and NEN 7510, and determines how you go into the external audit.
  • You receive an audit report with findings per requirement and an action plan with priorities.
Three frameworks

What we audit against

NIS2 and the Cybersecurity Act

Legislation, not a standard with a certificate. We test whether your duty of care and reporting obligation are actually in place: risk assessment, measures, the incident process, supplier management and board accountability. Outcome: can you demonstrate compliance.

ISO 27001

The international standard for information security. We audit the management system and the Annex A controls, including the Statement of Applicability and the justification for exclusions. Both as preparation for certification and in the annual cycle afterwards.

NEN 7510

The Dutch standard for information security in healthcare, built on ISO 27001 with additional requirements for patient data. For healthcare providers and their suppliers we include those additional requirements in the audit.

Division of roles

What we do and do not do

Internal and external audits are often confused, and that costs time in a certification programme. So, explicitly:

What Newblend does
  • Internal audits, with our own auditor
  • Baseline: where you stand now against the standard
  • Audit report with findings per requirement
  • Action plan, prioritised by risk
  • Preparation for the external audit
  • The annual internal audit cycle after certification
What Newblend does not do
  • Issue certificates. Only an accredited certification body may do that
  • Carry out the external certification or recertification audit

If one of these points is part of your programme, we tell you in advance which party you need for it.

Way of working

How an audit runs

  1. STEP 01
    Define scope

    Which parts of the organisation, processes and systems fall within the audit, and which standard we test against. Agreed before we start.

  2. STEP 02
    Documentation

    Reviewing policy, procedures, risk analysis and registers. What is on paper, and does it match the requirements.

  3. STEP 03
    Interviews and testing

    Conversations with process owners and sample checks in practice. Comparing paper with reality.

  4. STEP 04
    Reporting

    Findings per requirement, with rationale and a distinction between nonconformities and improvement opportunities. Usable in the management review.

  5. STEP 05
    Follow-up

    Action plan with priorities and owners, and a retest on the points you have addressed.

Independence

Our own auditor, deployed independently

Our auditor is not part of the management teams and does not assess their own work. That lets us audit independently: the findings are what they are, even when they are inconvenient.

Having an in-house auditor makes the programme shorter. You do not need to brief an external firm on your organisation, and the auditor knows the technology the requirements are about.

When is an internal audit mandatory
  • ISO 27001 requires an internal audit within the annual cycle, plus a management review.
  • NEN 7510 follows the same approach, with the additional healthcare requirements.
  • NIS2 does not prescribe an audit, but does require you to demonstrate that your measures are appropriate. An audit is the practical way to record that.

Frequently asked questions

Can Newblend certify us for ISO 27001?

No. A certificate may only be issued by an accredited certification body. We carry out the internal audits needed to obtain and keep that certification, and provide the reporting you take into the external audit.

What is the difference between an internal and an external audit?

An internal audit is the organisation's own check of its management system, mandatory under ISO 27001 and NEN 7510. An external audit is carried out by the certification body and leads to the certificate. The internal audit determines how you go into that external audit.

How can your auditor be independent?

Independence means the auditor does not assess work they set up themselves. Our auditor sits outside the management teams and has no stake in the outcome.

How long does an internal audit take?

That depends on the size of the scope and the state of your documentation. Once the scope is set, you know what lead time and effort the audit requires; we agree that in advance.

What do you deliver after the audit?

An audit report with findings per requirement, the rationale for each finding, a distinction between nonconformities and improvement opportunities, and an action plan with priorities. The report can be used as input for the management review.

Read more

Do you know whether you can demonstrate it?

A baseline assessment shows where you stand against NIS2, ISO 27001 or NEN 7510, and what still needs to happen before an external auditor visits.