A three-year proposal for 24/7 managed detection and response, an incident response retainer and staff training across all six St. Aldric hospitals. It's organized around one night, start to finish.
Five people sign this. Each of them gave us one sentence in the discovery calls, and the rest of this page is built to answer them.
“If a nurse has to log in one more time, I'm out.”
“Show me what happens at three in the morning. Not the slide.”
“I need one number I can defend to the board.”
Drag the timeline or press play. Four lanes, minute by minute. What the attacker tries, what our analysts see, who gets a call, and what happens on the ward.
Simulated exercise. Built from the containment playbook we'd agree with your team in onboarding. People named are your signers and our shift. Systems and times are illustrative.
Three services, one contract, one phone number. The replay you just watched is all three working together.
Managed detection and response, 24 hours a day, every day of the year. Analysts watch every laptop, server, account and inbox across six hospitals and act on the playbook you approve.
An incident response retainer. If something gets past the playbook, our responders are on your bridge within the hour, with forensics, recovery and counsel support already contracted.
Phishing practice and short training for 11,000 staff, scheduled around shifts. Nobody gets tested during a declared code, and results stay private to St. Aldric.
Jump to your chapter. Every one is written so you can sign off without booking a call.
We plug into what you already run. Nothing gets replaced in year one, and nothing on a clinical workstation reboots during a shift.
Every hospital starts in watch-only mode. We only switch a site to enforce after two full shifts with no change in login times or EHR response, measured by your own team.
If anything looks off, rollback is one command per site and takes under ten minutes.
These response times are in the contract with service credits behind them. Miss either one twice in a quarter and you can leave with 90 days' notice and no penalty.
You'll have named shift leads who know Westbrook from Harbor, and a direct line to the analyst holding your case. No ticket queue at 3 a.m.
We won't quote you industry breach costs. You know your own revenue better than any survey, and you watched what diversion did to a neighbor.
Slide in your figures. We've put placeholders in so it isn't empty. Your finance team should replace them before this goes to the board.
Uses the annual total from the coverage builder below, which updates as you change it. Recovery costs, fines and legal fees are left out on purpose.
No new logins, no new pop-ups and no new passwords. Badge tap stays badge tap. Our agent has no window, no tray icon and no alerts that a clinician can see.
Alerts go to IT and to us. They never go to a nurse's station.
Under HIPAA, a breach of patient information starts a notification window of no more than 60 days from discovery. We never decide whether something is a breach. You do, with the facts we hand you on a schedule.
We sign your business associate agreement before onboarding starts, keep a chain of custody on every piece of evidence, and can run an investigation under your direction so privilege is protected.
Valley goes first because it's smallest. Children's goes last because its units can least afford surprises. Tick things off as you read, and see how each site gets from watch-only to fully covered.
Build the coverage you want. The base stays the same in every version, and every other line can come off on its own. When you turn one off, it says exactly what you'd lose.
Analysts, named shift leads, the response commitments in Renee's chapter, monthly reviews. The same in every version of this deal.
14,000 laptops, workstations and servers at $120 each a year. Your inventory counted about 14,000.
$85,000 per hospital a year. A passive sensor in the comms room, on-site onboarding and a named site lead.
Passive watch over pumps, monitors and imaging, up to 9,000 devices.
Devices drop out of view. We'd still see anything they talk to on the network, but not the devices themselves.
All 11,000 staff, quarterly, scheduled around shifts.
No practice emails or lessons. Billing and HR, the usual first target, get no extra training.
Pre-paid responder hours at $310 an hour, for anything beyond the playbook. Unused hours convert to exercises.
Our pick is everything as shown. Keep all six hospitals and the device monitoring. That's where the gaps are in health systems your size. If the number has to come down, take the retainer to 100 hours first. The base already covers responding to anything we catch.
Sign by November 21 and Valley starts the first week of December, ahead of the January surge.
BAA signed, kickoff with all five signers, Valley in watch-only.
Site by site, watch-only to enforce. Checklist above.
Your leadership runs the replay live, with real phones.
What we saw, what we stopped, what we'd change.
We try to get in, the way someone else would. You get the report.
Six months' notice. No auto-renew, no surprise increase.
Quarterly in advance, net 30. The annual total holds for all three years. No setup fee. Onboarding is inside the base.
If we miss a response commitment twice in one quarter, you can end the contract with 90 days' notice and no penalty. Otherwise the term is three years.
It stays in US data centers, it's yours, and it's deleted within 30 days of the contract ending, with a certificate. We sign your business associate agreement before anything connects.
We carry $25M in cyber and professional liability insurance and name St. Aldric as an additional insured. Certificates go to Priya before signature.
Add endpoints or a hospital at the same rate at any time. Removing coverage takes effect at the next quarter.
That's the whole job. Here's how we start.
Reply with any changes, or accept as built. We'll send the agreement and BAA the same day.
Signatures from the five of you. Priya gets our insurance certificates first.
Kickoff on site at Valley, then the 90-day plan begins.