Raw

Aldergate has confirmed most baseline security requirements, but the approved‑package list, the architecture diagram, and detailed storage‑encryption guidance are still missing, so today you need to follow up on those items.

**Confirmed compliance answers**  
- A security review is mandatory before production; the need for a penetration test will be decided during that review. (Source 1)  
- An internal hardening framework exists, but a review is still required regardless of conformance. (Source 1)  
- A policy on open‑source dependencies is in place; the approved‑package list will be sent to Fernfield. (Source 1)  
- Critical dependencies will be assessed during the security review. (Source 1)  
- Fernfield staff may work from Ireland (outside the UK). (Source 1)  

**Outstanding compliance items**  
- The approved‑package list has not yet been received (promised 12 May, then 9 July). (Source 1, 2, 3)  
- A draft architecture diagram has been prepared but not shared with Aldergate, blocking answers on data‑storage location, encryption, and logging. (Source 2, 3)  
- Specific turnaround time for dependency approval remains undefined. (Source 1)  
- Detailed storage‑encryption and logging requirements cannot be answered without the architecture diagram and design walkthrough. (Source 1)  

**Immediate actions for today**  
- Prompt S. Okafor (information security owner) to deliver the approved‑package list.  
- Send the draft architecture diagram to Aldergate’s compliance contact (Whitcombe/Okafor) before the next sync.  
- Request clarification on the expected turnaround for dependency approvals.  

These steps will unblock the remaining compliance questions and allow pricing of the build phase.