#Normen Supplier Conformance Statement

STM-NO-001 v1.0.0, Last Modified On 01 August 2026, Tier: Public

Edsol Edtech Pvt. Ltd. holds no certification and no accepted self-declaration against Normen as at 01 August 2026. This statement says what Normen is, how it binds a supplier, exactly which requirements Pensieve Labs meets and which it does not, and what it costs to close the gap. A supplier declaration that claims blanket conformance is worth nothing to a Norwegian buyer and the directorate's own guidance discourages buyers from asking for one.

---

#Applicability

---

#1. What Normen is, and how it reaches Pensieve Labs

Normen is the Norwegian health and care sector's own binding information security and privacy norm, administered by the health directorate with a sector steering group. Its current version is 7.0, and the stated purpose of that revision was to bring it into line with the Norwegian digital security legislation. It is compiled in alignment with ISO/IEC 27001 and ISO/IEC 27002, which tells a supplier what vocabulary the buyer is thinking in.

Normen contains on the order of three hundred "shall" requirements.

Normen is not a statute. It binds by contract, in two ways:

1. Through health network membership. Members accept Normen as a condition of the membership terms. That is how the great majority of Norwegian health undertakings become bound.
2. Through the processing agreement. The hospital, being bound, flows Normen down to Edsol Edtech Pvt. Ltd. in the databehandleravtale.

Normen's own text is explicit that the processor is responsible for ensuring that sub-suppliers meet their obligations, and that failure to implement required measures is a material breach of the agreement and the supplier must remedy the deficiency at its own expense so that processing can resume.

Read that again, because it is a pricing input. Normen non-conformity is drafted as a remedy-at-your-own-cost material breach. Any Norwegian contract Pensieve Labs signs will contain it. It must be priced, and it must be scoped: Pensieve Labs accepts the obligation against a named version and a named requirement mapping, not against "Normen" in the abstract. Section 7.

---

#2. The supplier-facing structure

The directorate publishes a supplier guide whose section map is the checklist Pensieve Labs is measured against.

---

#3. The five fact sheets that decide a deal

The norm's fact sheets are approved and managed by its steering group. Of the full set, five decide a Pensieve Labs deal, and Pensieve Labs prepares against them specifically rather than against the whole library.

The migration fact sheet deserves specific attention. A Norwegian hospital replacing an incumbent record system will hold Pensieve Labs to a documented conversion plan covering completeness, correctness, traceability of transformation, and what happens to the source system afterwards. Pensieve Labs produces it before migration begins, not during, and CHK-GL-013 carries the validation items.

---

#4. The requirement response: how Pensieve Labs answers, and how a buyer should ask

The directorate publishes the mapping workbooks that Norwegian buyers paste into their tender documents: the norm's requirements mapped against procurement requirements, against ISO/IEC 27001 and against the ISO/IEC 27002 controls, together with a guide to using the norm's requirements in procurement.

Pensieve Labs's method: answer that workbook line by line, before a tender exists, with one of four verdicts per requirement, and publish the summary.

A response with no "not met" rows is not a response. A Norwegian buyer who receives three hundred "met" verdicts concludes the supplier did not read the workbook.

Use the directorate's own guidance to shrink the review. It advises buyers not to write "the supplier shall comply with Normen" but to specify concrete, evaluable requirements matched to the service type. When a hospital sends a blanket conformance demand, Pensieve Labs cites that guidance and proposes the mapped requirement matrix instead. That is a legitimate, sourced way to convert an unanswerable demand into an answerable one, and the matrix is more onerous than the blanket demand, not less.

---

#5. The cloud controls matrix: the free credibility instrument Norway has endorsed

The directorate cites the Norwegian cloud security community's mapping of Normen to the cloud controls matrix, on the basis that it lets customers and suppliers speak the same language when procuring cloud services.

That is the highest-leverage fact in the Norwegian section, because the associated self-assessment questionnaire is free, self-completed and publicly postable. Completing and publishing it converts Pensieve Labs's "no certifications" position into a sector-recognised vocabulary at effectively zero cost, in a country that has officially blessed the mapping.

QRE-GL-005 is Pensieve Labs's self-assessment. The Norwegian-specific action is to publish the crosswalk from it to the Normen requirement numbers, so a Norwegian buyer can read one document and find its own requirement identifiers.

---

#6. The self-declaration scheme: status, stated accurately

The local-government association and the health directorate have been developing a supplier self-declaration form as part of a framework for safe digitalisation, intended to give a unified way to verify information-security and privacy compliance. The directorate's framing is commercially explicit: suppliers who meet the requirements gain a competitive advantage.

It was not available in submittable form as at 01 August 2026. [UNVERIFIED: check monthly. no/README.md Section 6 item 4.]

Direct answer to the question a founder will ask: no, a Normen self-declaration is not currently a substitute for a security certificate, because the scheme does not yet exist in submittable form. But that framing is the wrong one. No Norwegian statute, no Normen requirement and no health network supplier term makes ISO/IEC 27001 a condition of supply. It is a de facto procurement requirement in the public segment and negotiable in the private one. no/README.md Section 5 ranks what Norway offers instead.

When the scheme opens, Pensieve Labs files on day one. It is the cheapest Norwegian credibility instrument available and it will be asked about from the day it exists.

---

#7. What Pensieve Labs will sign, and what it will not

Version control matters. The norm is revised, and a revision can add requirements. MSA-EU-001 clause 5.9 commits Pensieve Labs to renegotiate a flow-down without charge where the underlying obligation changes; the same principle is applied to a Normen version change, and the Order Form records the version in force at the effective date.

---

#8. Current position, requirement family by requirement family

An honest summary. The line-by-line response is [TO BE SUPPLIED] and is a market-entry deliverable.

---

#9. Limitations

9.1 No certification and no accepted self-declaration. Stated on the first page and repeated here.

9.2 The line-by-line response does not yet exist. Until it does, Pensieve Labs should not represent that it has answered the norm. Producing it is 20 to 40 elapsed days of consultant and engineering time and it is market-entry work, not per-deal work.

9.3 Version drift. This statement is written against version 7.0. A new version reopens Section 8.

9.4 Normen is in Norwegian. The working documents, the workbooks and the fact sheets are Norwegian. The translation cost is real and is routinely underestimated.

9.5 This is not Norwegian legal advice.

---

#10. Related documents

---

#11. Signature

---

#12. Change history