Raw

Build-phase pricing is stalled by three compliance gaps: the approved package list is overdue, the data storage answer requires an architecture diagram we hold, and our Lisbon engineering presence lacks confirmation.

Fernway is ready to price the build phase, but Aldergate's compliance track has exposed critical uncertainties. While the bank has confirmed the mandatory security review and dependency assessment process, they have withheld the data storage answer pending our architecture diagram, and the approved package list is now nearly three months late. Furthermore, Aldergate has not responded to our query about engineers based in Lisbon, leaving our remote work capability unverified.

● **Highest-Risk Gaps (External Delays)**
• **Approved package list:** Not received; promised 12 May (D. Mercer) and 9 July (R. Whitcombe); now 98 days overdue.
• **Owner:** S. Okafor (Information Security Owner), via R. Whitcombe.
• **Impact:** Build-phase price cannot be fixed without this list. [gate-review.xlsx; sync-0709.md; risk-register]

• **Lisbon engineers:** Fernway noted two staff in Lisbon on 9 July; no Aldergate response.
• **Status:** Only Ireland is confirmed as acceptable; Lisbon remains unapproved.
• **Impact:** Potential rework or relocation costs if Lisbon is rejected. [sync-0709.md; gate-review.xlsx]

● **Controllable Gaps (Internal Actions Needed)**
• **Data storage/encryption/logging:** Answer declined without architecture diagram and design walkthrough.
• **Action:** Send draft architecture diagram (exists since 11 Aug) to unlock this answer.
• **Impact:** Blocks final security sign-off and storage cost validation. [gate-review.xlsx; sync-0709.md; risk-register]

● **Confirmed Requirements**
• **Security review:** Mandatory before production; assigned reviewer decides on penetration test scope.
• **Standards:** Internal hardening framework exists; review required regardless of conformance.
• **Dependencies:** Usage assessed case-by-case during review; turnaround is ad hoc.
• **Location:** Work from Ireland is acceptable. [gate-review.xlsx]