Raw

**Answer:** We have confirmed that a security review is required, an internal hardening framework exists, and Fernway staff can work from Ireland, but we still need Aldergate’s approved‑package list, a finalized architecture diagram, and detailed storage‑encryption requirements before we can price the build phase.

**What’s already answered**  
- **Security review mandatory** – “A review is mandatory” (Source 1 Q1).  
- **Internal hardening framework** – “An internal hardening framework exists” (Source 1 Q2).  
- **Open‑source policy exists** – “A policy exists; the approved‑package list will be sent to Fernway” (Source 1 Q3).  
- **Dependency assessment** – “Dependency usage is assessed during the security review” (Source 1 Q4).  
- **Staff location** – “Work from Ireland is acceptable” (Source 1 Q6).  

**What’s still missing from Aldergate**  
- **Approved‑package list** – promised on 12 May (Mercer) and again on 9 July (Whitcombe) but not received (Source 2; Source 3 R‑11).  
- **Architecture diagram** – needed to answer storage/encryption questions; draft exists but not yet sent (Source 2; Source 3 R‑14).  
- **Storage, encryption & logging details** – “cannot be answered without an architecture diagram and a design walkthrough” (Source 1 Q7).  
- **Turnaround time for dependency approval** – “no standard turnaround; case‑by‑case” (Source 1 Q5) – no concrete timeline from Aldergate.  

**Immediate actions for Fernway**  
1. **Send the draft architecture diagram** to Aldergate before the next sync (agreed in Source 2).  
2. **Follow up with S. Okafor** (information security owner) to obtain the approved‑package list (no date attached in Source 2).  
3. **Request clarification on dependency‑approval turnaround** to set expectations (implicit gap from Source 1 Q5).  

These steps will unblock the compliance questions and allow the build‑phase pricing to be finalized.