Raw

Build-phase pricing is blocked by three outstanding items: the approved package list is 98 days overdue, Fernway's Lisbon engineers lack location clearance, and storage answers require an architecture diagram we haven't sent yet.

You are setting the build-phase price for Aldergate. The security review process and baseline policies are confirmed, but critical information gaps prevent a fixed cost.

**Confirmed Compliance Baseline**
- Security review is mandatory; whether a penetration test is needed is decided during the review [Source 1].
- An internal hardening framework exists, but a review is required regardless of conformance [Source 1].
- Critical dependencies are assessed case-by-case with no standard turnaround time [Source 1].
- Staff may work from Ireland; requests for other countries are not yet addressed [Source 1].
- A policy on open-source dependencies exists, and the approved list was promised by D. Mercer [Source 1].

**Outstanding Requirements & Actions**
- Approved package list: Not received despite commitments on 12 May and 9 July; currently 98 days overdue [Source 1], [Source 2], [Source 3].
- Remote work locations: Fernway engineers in Lisbon have no confirmed status; Aldergate did not respond to the location remark [Source 2].
- Data storage and encryption: Answers were declined pending an architecture diagram; a draft exists internally but has not been shared [Source 1], [Source 3].
- Compliance ownership: S. Okafor is the information security owner; Whitcombe continues to pass questions [Source 2].