Map services to dependencies
An administrative support session may cross from a vendor access broker into recovery management. A working backup may still depend on an unavailable identity provider before a restored clinical application can be used. We connect these technical details to an agreed service boundary.
List the business or care services first, then map the applications, identity systems, networks and providers that support them. Record which owner can authorise each component. A domain count alone cannot describe the permission boundaries or operational consequences.
Prepare roles and representative data
Supply dedicated identities with documented roles and known expected permissions. Use more than one tenant, customer or organisational unit where boundaries are part of the objective. Label canary objects so testers and owners can distinguish them from real records.
Choose the assessment areas
- Clinical network segmentation testing: A network diagram records intent. Hospital estates need evidence of the actual source-to-destination paths, including legacy exceptions and shared services required for clinical operations.
- EHR, PACS & clinical integration testing: User interfaces, interface engines and archive services may apply different permissions. The scope must explain whether the test covers the application, infrastructure, an integration or all three.
- Hospital ransomware-path & recovery testing: Ransomware readiness is wider than confirming a backup job succeeded. Excessive recovery roles, persistent support sessions and missing identity dependencies can undermine an otherwise sound recovery design.
Agree the test conditions
Agree stop conditions with clinical operations and biomedical engineering. Exclude treatment changes and active interrogation of sensitive devices unless specifically approved. Use a canary clinical workflow, controlled rates and a named on-call decision maker for every test window.
- Named test sources, destinations and permitted interfaces.
- Approved time windows, rate limits and excluded methods.
- Third-party consent, control contacts and stop authority.
- Evidence handling, cleanup, reporting and retest responsibilities.
Keep changes visible
Record material releases, new routes and permission changes during the test. If an unexpected path reaches a system outside the authorised boundary, pause and resolve scope through the named decision maker. Record untested dependencies in the final coverage statement.
