Standard scope of work

Unified NW, LLC will perform an independent, point-in-time security assessment of one enterprise Avaya Aura or Lucent DEFINITY phone system, its remote sites, the systems it connects to, and every endpoint where its calls end.

The assessment finds security weaknesses in the voice platform, rates each one, maps it to the HIPAA Security Rule, and hands back a prioritized remediation plan. It is built to be repeated every year, so each assessment can be compared with the last.

The scope is deliberately limited to the voice platform. This is not an enterprise-wide penetration test, and it does not replace the client's broader IT security program. Keeping it narrow is what makes it fast, fixed-price and hard to dilute.

Unified NW is a Kaseya International Premier Security Partner.

These terms set what each price covers. They are used the same way throughout this document.

The Core PBX assessment covers fourteen domains. Each check below is performed against the core and the adjuncts connected to it.

Discovery uses read-only access and configuration exports, such as list configuration all, list station, list registered-ip-stations, list trunk-group and the history log, together with active, non-destructive testing.

Each remote site on the same PBX/ACD network adds the site-level checks below to the Core PBX assessment.

• Media or branch gateway and survivable server configuration, firmware and administrative access.
• The site's voice VLAN, firewall rules and VPN path back to the core.
• Local trunks (analog, PRI or SIP) and their restrictions.
• A sample of each endpoint model and firmware version at the site.
• Rogue voice traffic sampling at the site through a remote collector or a port mirror.
• Site emergency calling location data.
• Site results in the reconciliation, the findings report and the baseline.

The audit runs in six phases and typically takes five to six weeks from kickoff to readout.

The schedule assumes access and data arrive within five business days of kickoff. Remote sites are assessed in parallel with the core.

Benchmarks used: the HIPAA Security Rule (45 CFR Part 164, Subpart C), NIST Cybersecurity Framework 2.0, NIST SP 800-66 Revision 2, the HHS 405(d) Health Industry Cybersecurity Practices, and vendor security hardening guidance.

Testing is authorized in writing, non-destructive, and stops the moment either side asks.

• A written authorization to test names the systems, IP ranges, phone numbers and assessment window. It is signed before any testing starts.
• No denial-of-service, load or failover testing on production systems. These tests can drop calls in a clinical setting.
• Exposure is proven, not exploited. Where a weakness could allow access, we demonstrate it to the minimum extent needed and stop. Deeper exploitation needs separate written approval.
• No call content is listened to, recorded or kept. Voicemail and recordings are checked for access and protection settings, not content.
• Tests that could affect service run in agreed windows, with the client's telecom contact and maintenance provider informed.
• Each side names an emergency contact. Either side can pause testing at any time.
• Critical findings go to the client's sponsor within one business day of discovery, ahead of the final report.

The client receives nine deliverables. Reports are PDF; the reconciliation and access register are also delivered as spreadsheets.

How findings are rated

Each finding is rated on the risk to the client's environment, not the risk in general. Where a published vulnerability applies, its CVSS score is shown alongside.

The following are not part of this engagement. Requests to add them are handled by written change order, so the voice audit keeps its focus and its fixed price.

• Hospital-wide or enterprise penetration testing of systems that are not part of, or connected to, the voice platform.
• Servers, workstations and network devices that do not host, carry or connect to voice services. The voice VLANs, firewall rules and paths that serve voice are in scope.
• Testing of the EHR or other business applications beyond the telephony integration point and its service accounts.
• Payment card, point-of-sale and medical device testing.
• Physical security testing, badge access and facility walk-throughs.
• Social engineering of staff beyond the controlled call-handling test.
• Denial-of-service, load and failover testing on production.
• Cloud collaboration platforms (for example Microsoft Teams or Zoom), except where they connect to the Avaya core.
• Carrier billing audits and the remediation work itself, which is quoted separately.

The schedule depends on the client providing access and information in the first week.

• A named project sponsor and a technical contact, with the telecom administrator available during discovery and testing.
• Read-only or browse-level accounts on Communication Manager, System Manager, Session Manager, the SBC, AES, CMS, messaging, recording and workforce systems, or configuration exports where direct access is not permitted.
• Network diagrams, the voice VLAN and IP plan, and the firewall rules that affect voice.
• A list of remote sites with addresses, gateways and endpoint counts.
• License entitlements and a summary of the maintenance contract.
• Remote connectivity and rack or virtual machine space for the assessment appliance at the core site.
• Notice to the integrator or maintenance provider, and approval of testing windows.
• A signed authorization to test and a business associate agreement.
• Disabling or rotating the assessment accounts when the engagement ends.

The assessment is a point-in-time, third-party evaluation. It is not a certification, a guarantee that the voice platform is secure, or a transfer of responsibility.

The client and its administrators, integrators and maintenance providers remain responsible for operating and securing the system.

Assumptions

• Delivery is remote, through a client-approved secure connection and an assessment appliance or virtual machine at the core site. On-site work, if requested, is quoted separately.
• Each Core PBX assessment covers one call-control system. Each additional independent call-control system is priced as another Core PBX.
• Endpoints are tested by sample of each model, firmware version and client type. The full endpoint inventory comes from configuration and registration data.
• Third-party systems, such as carrier networks and vendor-hosted services, are assessed only where they connect to the voice platform and only as their providers permit.
• Results reflect conditions during the assessment window. Configuration can change afterward.

Data handling and confidentiality

• Where testing may expose protected health information, a business associate agreement is signed before work begins.
• Evidence is collected only as needed (configuration exports, scan results and screenshots), stored encrypted and used only by the assessment team.
• Credentials provided for the assessment are used only for the assessment.
• Reports are confidential and delivered to named recipients only.
• Evidence is kept to support the next annual comparison for the period set in the agreement, then securely destroyed.

The audit is priced as fixed fees per annual assessment: $5,500 for the Core PBX and $650 for each remote site on the same PBX/ACD network.

• Fees include remote delivery and every deliverable in Section 07.
• Payment terms, the start date and the final site list are confirmed on the signed proposal.
• Out-of-scope requests are handled by written change order before any work begins.

These services are not included in the audit fee. Each is quoted separately on request.

Avaya, Avaya Aura, Communication Manager and related product names are trademarks of their owners. Lucent and DEFINITY are trademarks of their owners. Unified NW is an independent assessor and is not affiliated with or endorsed by Avaya.