Raw

Compliance is partly defined, but Fernway cannot price the build phase until it closes three open items with Aldergate: the architecture-based data controls, the approved dependency list, and a confirmed staffing-location position. [risk register R-07, R-11, R-14]

**Already answered**

- A security review is mandatory before production; the assigned reviewer will decide during that review whether a penetration test is required. Conforming to Aldergate’s internal hardening framework does not replace the review. [gate review Q1–Q2]
- Dependency use, including critical dependencies, will be assessed in the security review. Ireland-based Fernway work is acceptable. [gate review Q4, Q6]
- Aldergate has an open-source policy and an approved-package list, but no standard turnaround time for approvals. [gate review Q3, Q5]

**Obtain from Aldergate now**

- Send the draft architecture diagram to enable the required design walkthrough, then obtain the specific customer-data storage, encryption, and logging requirements; Aldergate declined to answer these without that context. The draft has existed since 11 August. [gate review Q7; sync-0709; risk register R-14]
- Escalate the approved-package list to S. Okafor, Aldergate’s information-security owner, with a dated commitment. It was first promised on 12 May and was still merely “being prepared” on 9 July; it remains open after 98 days. [gate review Q3; sync-0709; risk register R-11]
- Get explicit approval or restriction for the two engineers in Lisbon. Only Ireland is confirmed; Aldergate did not respond when Portugal-based staffing was raised. [gate review Q6; sync-0709]