Raw

**Answer:** We can price the build phase now that the mandatory security review and most policy questions are clear, but we must still obtain the approved‑package list and the architecture diagram (to resolve data‑storage and encryption requirements) before the compliance track can be closed.

**What’s already answered** (Situation + Complication)  
- **Security review is required** and will decide if a penetration test is needed (Source 1 Q1).  
- **A hardening framework exists**, but a review is still required regardless of conformance (Source 1 Q2).  
- **Open‑source policy and dependency handling** are defined: a policy exists, critical dependencies are assessed during the review, and staff may work from Ireland (Source 1 Q3‑Q6).  
- **Turnaround for dependency approval** is case‑by‑case, not fixed (Source 1 Q5).  

**What still needs to be obtained** (what the tech lead must act on)  
- **Approved‑package list** – promised on 12 May (Mercer) and again on 9 July (Whitcombe) but not yet received (Source 2; Source 3 R‑11).  
- **Architecture diagram** – required to answer where customer data can be stored and the encryption/logging requirements; draft exists since 11 Aug but has not been sent to Aldergate (Source 2; Source 3 R‑14).  
- **Storage‑and‑encryption details** – cannot be answered without the architecture diagram and a design walkthrough (Source 1 Q7).  

**Immediate actions for today**  
1. Follow up with S. Okafor (information‑security owner) to expedite the approved‑package list.  
2. Send the draft architecture diagram to Aldergate before the next sync to unlock the storage‑encryption answer.  
3. Record the pending items (approved‑package list, architecture diagram) in the risk register as blockers for pricing.