How to compare proposals fairly
Ask each provider to price the same clinical networks, EHR/PACS integrations and remote maintenance and explain assumptions about roles, access, environments and test windows. Request relevant delivery-team evidence and a report sample. Compare the proposed testing and retesting work before comparing day rates; the lowest number may describe a different engagement.
Evaluate the proposed work and team
Request named delivery roles, relevant experience, availability and evidence supporting any professional claims. Confirm whether subcontractors are involved and how independence or conflicts are managed. This website makes no unverified certification or accreditation claim.
Hospital testing needs an operational plan: clinical owners, device exclusions, vendor permissions, escalation and a realistic response when the environment changes during the test.
Make the proposal specific
- Objectives, systems, roles, scenarios and explicit exclusions.
- Operating windows, safety controls, test data and supplier permissions.
- Named responsibilities for incident escalation and stop decisions.
- Secure evidence transfer, retention, confidentiality and data processing.
- Reporting, remediation discussions, included retests and change control.
Review a sample for substance
Look for actual observations and verifiable acceptance criteria. A scan finding without validation or an attack narrative without scope limits is hard to use. Compare the sample’s technical detail with what the proposal commits to deliver.
Our Hospital AG sample is clearly fictional and available for this evaluation.
Understand the basis for duration and fees
Systems, roles, business logic, third parties and operational windows determine the work. There is no public fixed-price package or guaranteed completion time. The agreed statement of work should show assumptions, inclusions, retest allowance and how changes affect the schedule.
Confirm the operational plan
Agree stop conditions with clinical operations and biomedical engineering. Exclude treatment changes and active interrogation of sensitive devices unless specifically approved. Use a canary clinical workflow, controlled rates and a named on-call decision maker for every test window.
Prepare a brief before the scoping call
Start with the hospital services that must remain available and the boundaries you need to assess. Make exclusions, vendor dependencies and clinical stop authority visible before technical scope expands.
Use the free hospital penetration testing brief builder to record objectives, assessment areas, constraints and NDA preferences. Review the proposed scope, then send it directly to Atlant Security through the contact form.
