Hospital Pentest Readiness Checklist: Before Testing Starts

Remove avoidable delays before the test

Before testing clinical networks, EHR/PACS integrations and remote maintenance, confirm the named owners, permitted environments, representative access and stop contacts. Missing access or ambiguous permissions can reduce useful coverage. Work through the checklist with technical and operational owners before agreeing the start date.

Define the objective

• Understand which access paths can reach clinical support services, how defenders respond and where recovery depends on systems outside the backup platform.
• Name the service owners and the decision the test must inform.
• Choose the applications, networks, identities and integrations in scope.

Establish permission

• Obtain written authorisation for each owned environment.
• Confirm supplier and shared-platform boundaries.
• Record prohibited methods and out-of-scope systems.

Prepare the operating plan

• Agree stop conditions with clinical operations and biomedical engineering. Exclude treatment changes and active interrogation of sensitive devices unless specifically approved. Use a canary clinical workflow, controlled rates and a named on-call decision maker for every test window.
• Name a primary and alternate stop authority.
• Agree communications, windows, request limits and incident escalation.

Prepare representative access

• Create synthetic records and dedicated test roles.
• Document expected cross-tenant and privileged access decisions.
• Set a confidential channel for technical information.

Plan delivery and closure

• Agree coverage, evidence, reporting and retention requirements.
• Assign remediation owners and include retest criteria.
• Reconcile introduced accounts, sessions and canary objects.