Controlled execution. Reproducible evidence.

01 — Authorise and prepare

Agree objectives, system ownership, third-party boundaries, test identities and representative data. Write the rules of engagement before execution. Include the environment version, communication channel and authority to pause activity.

Agree stop conditions with clinical operations and biomedical engineering. Exclude treatment changes and active interrogation of sensitive devices unless specifically approved. Use a canary clinical workflow, controlled rates and a named on-call decision maker for every test window.

02 — Model the attack path

Hospital testing needs an operational plan: clinical owners, device exclusions, vendor permissions, escalation and a realistic response when the environment changes during the test.

• Can a supplier session cross from remote support into clinical infrastructure?
• Can a non-clinical account change a seeded referral workflow?
• Can an isolated clinical service be restored with its identity and integration dependencies?

Use these questions to choose a realistic sequence and a bounded proof point. Explain where an assumed starting position or supplied credential will limit the conclusion.

03 — Execute and observe

Combine approved discovery with manual validation. Keep request rates and actions within the operating plan. Record successful and blocked operations with the identity and context used. Stop at agreed proof rather than expanding access simply because it is technically possible.

04 — Reconstruct the evidence

Reconcile tester observations with application, identity and defence records. Distinguish a response from a confirmed state change, a reachable host from usable authority and an assisted scenario from unaided access. Record clock differences that affect the timeline.

05 — Remediate and retest

Prioritise by the demonstrated path, reachable business operation and control context. Agree owner, due date and acceptance criteria. Separate an executed retest from a future plan, and preserve the findings that remain open.