{
  "refs": {
    "e1": {
      "name": "SOC 2 Type II readiness",
      "role": "heading"
    },
    "e10": {
      "name": "Scope & control mapping",
      "role": "heading"
    },
    "e11": {
      "name": "Policy set approved",
      "role": "heading"
    },
    "e12": {
      "name": "Evidence automation",
      "role": "heading"
    },
    "e13": {
      "name": "Q3 access review",
      "role": "heading"
    },
    "e14": {
      "name": "Penetration test",
      "role": "heading"
    },
    "e15": {
      "name": "Readiness assessment",
      "role": "heading"
    },
    "e16": {
      "name": "Observation window opens",
      "role": "heading"
    },
    "e17": {
      "name": "Scope",
      "role": "region"
    },
    "e18": {
      "name": "Scope",
      "role": "heading"
    },
    "e19": {
      "name": "Blockers",
      "role": "region"
    },
    "e2": {
      "name": "At risk",
      "role": "region"
    },
    "e20": {
      "name": "Blockers",
      "role": "heading"
    },
    "e21": {
      "name": "Pen-test vendor cannot start before 6 October",
      "role": "heading"
    },
    "e22": {
      "name": "Nine engineers still hold standing production access",
      "role": "heading"
    },
    "e23": {
      "name": "Two subprocessors have no countersigned DPA",
      "role": "heading"
    },
    "e3": {
      "name": "At risk",
      "role": "heading"
    },
    "e4": {
      "name": "Needs a human",
      "role": "region"
    },
    "e5": {
      "name": "Needs a human",
      "role": "heading"
    },
    "e6": {
      "name": "Approve the second pen-test vendor, or accept the slip",
      "role": "heading"
    },
    "e7": {
      "name": "Sign off the standing-access model",
      "role": "heading"
    },
    "e8": {
      "name": "Milestones",
      "role": "region"
    },
    "e9": {
      "name": "Milestones",
      "role": "heading"
    }
  },
  "snapshot": "- document:\n  - main:\n    - text: Project status \u00b7 week 37\n    - heading \"SOC 2 Type II readiness\" [ref=e1] [level=1]\n    - term: Owner\n    - definition: Priya Raman\n    - term: Reported\n    - definition: 8 Sep 2026\n    - term: Next review\n    - definition: 15 Sep\n    - term: Window opens\n    - definition: 1 Nov 2026\n    - region \"At risk\" [ref=e2]:\n      - heading \"At risk\" [ref=e3] [level=2]\n      - text: Changed from On track\n      - paragraph: The penetration test is now the entire critical path. Our vendor cannot start before 6 October and the 10 October readiness assessment needs their report, so a two-week slip in the test is a two-week slip in the window. Everything else is on or ahead of schedule.\n      - paragraph: \"Since last week: evidence automation closed on 21 August and the access review passed 60%. The pen test moved from 22 September to 6 October when the vendor reassigned our team \u2014 that one change is why this is amber.\"\n    - region \"Needs a human\" [ref=e4]:\n      - heading \"Needs a human\" [ref=e5] [level=2]\n      - list:\n        - listitem:\n          - text: \"01\"\n          - heading \"Approve the second pen-test vendor, or accept the slip\" [ref=e6] [level=3]\n          - paragraph: Decision by Priya Raman Needed by 12 September\n          - paragraph: The second vendor can start 22 September for \u00a39,400 more. Doing nothing moves the window to 15 November, pushing the report past the two enterprise renewals that asked for it.\n        - listitem:\n          - text: \"02\"\n          - heading \"Sign off the standing-access model\" [ref=e7] [level=3]\n          - paragraph: Decision by Marcus Lee & Security Needed by 19 September\n          - paragraph: Break-glass only, or named exceptions with a quarterly review \u2014 both are built. The access review cannot close until one is chosen, and it is the last thing between us and 104 of 104 controls.\n    - term: Milestones\n    - definition: 3 of 7\n    - paragraph: complete \u00b7 1 in progress\n    - term: Open blockers\n    - definition: \"3\"\n    - paragraph: 1 needs a decision this week\n    - term: Days to window\n    - definition: \"54\"\n    - paragraph: opens 1 November\n    - term: Budget used\n    - definition: 68%\n    - paragraph: \u00a361K of \u00a390K\n    - region \"Milestones\" [ref=e8]:\n      - heading \"Milestones\" [ref=e9] [level=2]\n      - list:\n        - listitem:\n          - text: 12 JUN\n          - heading \"Scope & control mapping\" [ref=e10] [level=3]\n          - text: Done\n        - listitem:\n          - text: 24 JUL\n          - heading \"Policy set approved\" [ref=e11] [level=3]\n          - text: Done\n        - listitem:\n          - text: 21 AUG\n          - heading \"Evidence automation\" [ref=e12] [level=3]\n          - text: Done\n        - listitem:\n          - text: 19 SEP\n          - heading \"Q3 access review\" [ref=e13] [level=3]\n          - text: In progress \u00b7 60%\n        - listitem:\n          - text: 6 OCT\n          - heading \"Penetration test\" [ref=e14] [level=3]\n          - text: At risk \u00b7 slipped 14d\n        - listitem:\n          - text: 10 OCT\n          - heading \"Readiness assessment\" [ref=e15] [level=3]\n          - text: Planned\n        - listitem:\n          - text: 1 NOV\n          - heading \"Observation window opens\" [ref=e16] [level=3]\n          - text: Planned\n    - region \"Scope\" [ref=e17]:\n      - heading \"Scope\" [ref=e18] [level=2]\n      - paragraph: Controls implemented 87 / 104\n      - paragraph\n      - paragraph: 84% \u00b7 the remaining 17 are all access-related\n      - paragraph: Evidence collected automatically 61 / 104\n      - paragraph\n      - paragraph: 59% \u00b7 target is 75 by the window opening\n      - paragraph: Policies approved 22 / 22\n      - paragraph\n      - paragraph: 100% \u00b7 signed off 24 July, no changes since\n    - region \"Blockers\" [ref=e19]:\n      - heading \"Blockers\" [ref=e20] [level=2]\n      - list:\n        - listitem:\n          - heading \"Pen-test vendor cannot start before 6 October\" [ref=e21] [level=3]\n          - text: Blocking\n          - paragraph: Owner Dana Whitfield Open 11 days Blocks 2 milestones\n          - paragraph: \"Needs: approval to run the test with our second vendor at +\u00a39,400, or a decision to move the observation window to 15 November.\"\n        - listitem:\n          - heading \"Nine engineers still hold standing production access\" [ref=e22] [level=3]\n          - text: Blocking\n          - paragraph: Owner Marcus Lee Open 4 days Blocks Q3 access review\n          - paragraph: \"Needs: the standing-access model signed off. Break-glass tooling has been built and tested since 2 September \u2014 this is waiting on a decision, not on engineering.\"\n        - listitem:\n          - heading \"Two subprocessors have no countersigned DPA\" [ref=e23] [level=3]\n          - text: Watching\n          - paragraph: Owner Legal Open 23 days Blocks nothing yet\n          - paragraph: \"Needs: countersignature from both vendors. Chased three times; escalate to their account teams if open on 22 September.\"\n    - text: Compiled 8 September 2026, 07:00 UTC from the compliance tracker, the access-review export and the project ledger. Milestone dates are committed dates, not forecasts; budget is spend to date against the approved \u00a390,000."
}