The Billing Vendor, the Shift Change, and the Subsidiary Nobody Mentioned
Your firm signed a fixed-fee SOW with a regional hospital group (three hospitals, 4,200 staff). Authorized targets: external ranges 203.0.113.0/24 and 198.51.100.0/24, plus "the patient portal." The SOW's testing-window clause says testing may occur at any time. On day 2 the CISO emails: "Also hit the billing vendor's portal - they host our payments, same data, so it's fine." That afternoon he mentions verbally that 07:00–09:00 is shift change and "you really shouldn't be poking the EMR then." Meanwhile your recon shows 198.51.100.0/24 is registered to Northlake Diagnostics LLC, a subsidiary named nowhere in the SOW. Your junior tester has already sent two HTTP probes to a host in that range.
1. How do you handle the CISO's request to test the billing vendor's portal?
Read the worked answer
Do not test it, and say so in writing the same day.
Reasoning: Authorization runs to systems the client controls, not to data the client owns. The billing vendor is a separate legal entity with its own assets, so the SOW's scope never extended to it, and "same data" is irrelevant to who may consent to testing. Testing without the vendor's own authorization exposes you and your firm to unauthorized-access liability regardless of the client's blessing.
Action: Reply by email, state that the vendor is outside the authorization boundary, and offer the path that would make it legal: a vendor-issued letter of authorization or a tri-party amendment, plus confirmation the vendor's own contracts permit testing. Log the request, your response, and the timestamp in the engagement record. If the client insists verbally, escalate to your engagement manager before any packets are sent.
2. The SOW permits any-time testing, but the CISO verbally asked you to avoid 07:00–09:00 and to stay off the EMR. What testing window do you actually run, and why?
Read the worked answer
Adopt the more restrictive of the two until you have written confirmation.
Reasoning: A verbal caution about shift change is a risk signal, not noise. It tells you the EMR and clinical workflows are availability-sensitive in a way the generic SOW clause does not capture, and hospital downtime is a patient-safety question, not a convenience question. The SOW gives you permission; it does not oblige you to use the maximum permission. The narrower window costs you little and removes the worst-case outcome.
Action: Send an email restating the verbal instruction and asking the CISO to confirm it as the operating window - that converts a hallway conversation into a record and protects you if the SOC later flags 08:00 traffic. Also confirm in writing whether the EMR is in scope at all; "the patient portal" does not obviously include it. Note any schedule or cost impact of out-of-hours work.
3. Your tester already probed a host in 198.51.100.0/24, which belongs to a subsidiary not listed in the SOW. What now?
Read the worked answer
Stop work in that range, preserve the evidence, and treat it as a scope deviation to be disclosed.
Reasoning: The range is in the SOW's target list but the registrant is a different legal entity. Either the client's asset inventory is wrong (the subsidiary is authorized but undocumented) or the SOW was copied from an old template (the range should never have been listed). You cannot resolve which from the outside, and the answer determines whether you have already crossed an authorization boundary. Two benign HTTP probes are low-impact, but the decision now is about disclosure, not impact.
Action: Pull the probe timestamps, source IPs, and full request logs. Notify the client's point of contact and your engagement manager in writing, ask for written confirmation that Northlake is an authorized party, and suspend that range until it arrives. If the probes had been exploit attempts or authentication attempts, escalate to legal and check the contract's incident-notification clause before continuing.