Engagements
Three engagement types, each scoped in writing before work starts.
We work with sequencing labs, biobanks, clinical genomics labs, genomic data platforms, instrument vendors and research groups. Fees are quoted per engagement after scoping.
Security assessment
ForSequencing labs, biobanks, clinical genomics labs and genomic data platforms.
A security assessment of the systems that produce, process and hold your genomic data, scoped to your instruments, run schedule and validated workflows rather than a generic IT checklist.
What we look at (chosen per engagement)
- Instrument hosts: control workstations, network services, baseboard management controllers, vendor remote-support channels, patch and field-notice status.
- Lab software: LIMS, instrument control and data collection software, user and service accounts, integrity of result files.
- Pipelines: workflow engine configuration, remote modules and containers, reference data provenance, credentials available to pipeline jobs.
- Data platforms: access control, bulk export paths, logging, data-sharing integrations.
- Network: segmentation between instruments, lab IT, analysis compute and cloud.
What you receive
- Findings report. Each finding has evidence, reproduction steps, its effect on the confidentiality, integrity or availability of genomic data, and a risk rating.
- Remediation plan ordered by risk and effort.
- Findings classified with GENOMIX technique IDs.
- Read-out session with your security, IT and lab leads.
- Retest of fixed findings, if included in the statement of work.
Vulnerabilities in a vendor’s product found during the assessment are reported to that vendor through coordinated disclosure, and to CISA where medical devices are involved. Timing and attribution are agreed with you in the statement of work before testing starts; the usual window is 90 days, adjusted with the vendor and CISA. Findings specific to your configuration stay confidential.
DOJ Data Security Program data-flow mapping
ForU.S. organizations whose data brokerage, vendor, employment or investment agreements with countries of concern or covered persons may involve bulk human genomic data. Under 28 CFR Part 202, obligations attach to those covered transactions, not to holding the data; bulk starts above 100 U.S. persons.
A technical map of where your genomic data goes and who can reach it, built so your counsel can assess obligations under the DOJ Data Security Program.
What we map
- Where genomic and related ’omic data is generated, stored, processed, backed up and sent.
- Third parties in the flow: sequencing service providers, instrument vendors with remote access, cloud providers and regions, analysis contractors, research collaborators.
- Technical access paths created by vendor, employee and contractor relationships, including remote support from outside the U.S.
- Controls on those paths: authentication, logging, encryption and data minimization.
What you receive
- Data-flow map: diagram plus a system and third-party inventory.
- Flows and access paths flagged for your counsel’s review under 28 CFR Part 202.
- Technical observations on the controls protecting each flagged path.
This is technical mapping. We are not a law firm, we do not give legal advice, and we do not decide whether a transaction is prohibited or restricted. We work alongside your counsel.
Research partnership
ForInstrument and software vendors, open-source maintainers, academic groups, biobanks and data holders.
Security research done with the people who build or run the systems, under terms agreed before work starts.
Forms it can take
- Security review of an instrument, lab application, workflow engine or pipeline, under agreed scope and disclosure terms.
- Joint research with co-authored publication.
- Review of GENOMIX techniques, or contribution of procedure examples to it.
What you receive
- Written terms covering scope, disclosure timelines, attribution and publication rights.
- Findings delivered privately to the affected maintainer or vendor before any publication.
How an engagement runs
- 01
Scoping call
What you operate, what concerns you, and the constraints that matter: validated clinical workflows, instrument service agreements, run schedules.
- 02
Statement of work
Targets, methods, testing windows, rules of engagement, deliverables and fee, agreed in writing. Nothing outside it is tested.
- 03
Fieldwork
Testing or mapping under the agreed rules, scheduled around instrument runs. Production instruments and validated systems are touched only with your explicit approval.
- 04
Report and read-out
Written deliverables, then a working session to walk through findings and the remediation plan.
- 05
Disclosure and follow-up
Vendor product vulnerabilities go through coordinated disclosure on the timeline set in the statement of work. Retesting happens if it is in scope.
Start with a scoping call.
Tell us what you run and what you need. We reply to every substantive request.