Kiteworks wins Dutch healthcare security certification

Kiteworks said on Sept. 17, 2026, that its platform and Zivver secure communications service have earned NEN 7510-1:2024 certification for healthcare data security in the Netherlands. The certification comes as Dutch regulators face rising breach notifications and sharper scrutiny of how sensitive patient data is protected across the wider healthcare ecosystem.

Why it matters: - The certification gives Dutch healthcare organizations a third-party validated option for handling sensitive patient data under the country’s healthcare security standard. - NEN 7510 compliance is legally required for Dutch healthcare providers, and organizations must now prove compliance rather than simply attest to it. - The certification also helps address security expectations that overlap with the Netherlands’ newer cybersecurity law implementing the EU’s NIS 2 Directive. - The timing matters after a 2025 ransomware attack on Clinical Diagnostics exposed sensitive records tied to about 850,000 people. - Dutch regulators logged 39,407 data breach notifications across all industries in 2025, up from 37,839 in 2024.

What happened: - Kiteworks announced it achieved NEN 7510-1:2024 certification for healthcare information security in the Netherlands. - The certificate, NL 3069.1.1, was issued by Brand Compliance B.V., an independent accredited third party. - The certification covers Kiteworks USA LLC and its affiliates, including Kiteworks Europe AG, Kiteworks PTE LTD, Kiteworks BG Ltd, Dracoon GmbH, 123formbuilder S.R.L. and Zivver B.V. - The single certification applies to the Kiteworks Control Plane and Zivver Secure Communications Services. - Kiteworks said the certification is relevant for Dutch healthcare organizations facing heightened cyber risk.

The details: - NEN 7510-1:2024 is the Netherlands’ information-security management standard for healthcare organizations. - The standard was published in December 2024 and follows the same controls as ISO 27001:2022, with healthcare-specific additions. - NEN 7510 compliance has been a legal requirement for Dutch healthcare providers since 2008. - Since 2023, organizations must prove compliance instead of only stating that they comply. - The Clinical Diagnostics incident involved a third-party laboratory, not a hospital, which shows that healthcare data security depends on vendors and other outside partners as well as providers. - In May 2026, the Dutch Health and Youth Care Inspectorate said Clinical Diagnostics had not complied with the required NEN 7510 standard at the time of the attack. - The regulator cited missing independent information-security audits and weak periodic risk assessments, and said working in accordance with NEN 7510 could have reduced both the likelihood and impact of the incident. - Rick Goud, Field CTO at Kiteworks, said independent auditing is what healthcare CISOs want to see when evaluating security claims. - Goud said Zivver already had NEN 7510 certification, and that Kiteworks being certified changes the conversation for customers. - Goud also said the certified platform gives auditors one governed system, one audit trail and one report rather than separate logs stitched together later. - Kiteworks said its platform creates one audit trail across email, file sharing, file transfer, forms, APIs and agents. - Kiteworks said that matters because many organizations cannot produce a complete AI data-access audit record within a single business day, and only 17% can do so within an hour. - Kiteworks also said European organizations report weaker AI governance than their general security controls suggest, and only 26% have deployed purpose binding, a control that limits AI agents to authorized tasks and data. - The company said the certified platform extends the same access controls and audit trail used for human users to AI agents handling patient data. - Kiteworks directed readers to its Compliance Brief for more information on the certification.

Between the lines: - The announcement positions certification as a differentiator in a market where many vendors can support compliance but have not had the software itself audited against the standard. - The third-party laboratory breach highlights a broader problem: healthcare data security risks often sit outside hospital walls. - The focus on AI governance suggests Kiteworks is linking healthcare compliance to a wider shift in how organizations control automated systems that touch sensitive data.

What's next: - Dutch healthcare organizations looking for NEN 7510-aligned tools may use the certification as part of vendor selection and audit preparation. - Kiteworks is likely to keep pitching the certification as proof that its platform can support both healthcare compliance and broader data-governance requirements. - More information is available in the company’s Compliance Brief, as referenced in the announcement.

The bottom line: - Kiteworks is betting that independently certified compliance, not just compliance-ready software, will matter more as Dutch healthcare oversight tightens and breach risk keeps rising.