Ninety days, mapped to milestones your program already runs.
A pilot is not a research project. The 90-day timeline below assumes one site and one engaged sponsor. It produces a defensible inventory by Day 30, an integrated feed by Day 60, and an evidence pattern by Day 90 that survives the next audit cycle.
Day 1 — ESE deployment, read-only switch access.
A CybrIQ External Scan Engine (ESE) instance is deployed at your chosen site. Local IT enables read-only SNMP for the ESE on the site's core switches. The appliance phones home over an existing tunnel. No agents touch any clinical device. No clinical workflow pauses.
Day 1 to 7 — initial device inventory.
Identity events accumulate. The first sweep lands in the dashboard and on the syslog feed within hours. By Day 7, the full population at that site is enumerated, including the biomedical and vendor-managed tail.
Day 7 to 30 — reconciliation and validation.
InfoSec and Clinical Engineering reconcile the new inventory against the CMMS. The handful of devices one organization had but not the other are surfaced. The §164.308 inventory methodology paragraph is drafted.
Day 30 to 60 — integration with the risk register.
The REST export is wired into GRC. The syslog feed is wired into the SIEM. Identity events surface alongside the rest of the security telemetry. If USB protection is in scope, the workstation agent is deployed to the highest-risk endpoints during this window.
Day 60 to 90 — first identity-drift event handled.
A new device, a moved device, a vendor service-engineer connection. The change feed surfaces it. The team handles it through the existing incident process. The pattern is exercised once before the audit cycle.
Day 90 — pilot decision.
Continue, expand to additional sites, or end. The artifacts produced during the pilot are yours regardless of decision. If you continue, the contract is twelve to thirty-six months on standard procurement terms.