Raw

Compliance is partly defined, but Fernway cannot fix build pricing until Aldergate confirms architecture-specific controls and releases its approved-package list.

**Already answered**

- A security review is mandatory before production; the assigned reviewer will decide during that review whether a penetration test is required. (`gate-review.xlsx`, Q1)
- Aldergate has an internal hardening framework, but meeting it does not replace the required review. (`gate-review.xlsx`, Q2)
- Ireland-based work is acceptable. (`gate-review.xlsx`, Q6)
- Dependency use, including critical dependencies, will be assessed in the security review; there is no standard turnaround time for approval. (`gate-review.xlsx`, Q4–Q5)

**Still needed from Aldergate**

- The approved-package list. It was first due from D. Mercer on 12 May and was again described as forthcoming by R. Whitcombe on 9 July, but remains outstanding after 98 days. (`gate-review.xlsx`, Q3; `sync-0709.md`; risk register R-11)
- Architecture-specific requirements for customer-data storage, encryption, and logging. Aldergate will not answer without an architecture diagram and design walkthrough. (`gate-review.xlsx`, Q7)
- Confirmation whether Lisbon-based Fernway engineers may work on the engagement; Aldergate only explicitly approved Ireland, and did not respond when Lisbon was raised. (`gate-review.xlsx`, Q6; `sync-0709.md`)
- Direct engagement with S. Okafor, the information-security owner, rather than relying on questions passed through Whitcombe. (`sync-0709.md`)

**Action today**

- Send the existing draft architecture diagram to Aldergate and request a design walkthrough with Okafor. The diagram has been ready since 11 August and currently blocks the storage-control answer. (risk register R-14)
- Ask Whitcombe/Okafor for a dated commitment on the approved-package list and written confirmation on Portugal-based staff.