The penetration test is now the entire critical path. Our vendor cannot start before 6 October and the 10 October readiness assessment needs their report, so a two-week slip in the test is a two-week slip in the window. Everything else is on or ahead of schedule.
Since last week: evidence automation closed on 21 August and the access review passed 60%. The pen test moved from 22 September to 6 October when the vendor reassigned our team — that one change is why this is amber.
complete · 1 in progress
1 needs a decision this week
opens 1 November
£61K of £90K
Controls implemented87 / 104
84% · the remaining 17 are all access-related
Evidence collected automatically61 / 104
59% · target is 75 by the window opening
Policies approved22 / 22
100% · signed off 24 July, no changes since
Needs: approval to run the test with our second vendor at +£9,400, or a decision to move the observation window to 15 November.
Needs: the standing-access model signed off. Break-glass tooling has been built and tested since 2 September — this is waiting on a decision, not on engineering.
Needs: countersignature from both vendors. Chased three times; escalate to their account teams if open on 22 September.
The second vendor can start 22 September for £9,400 more. Doing nothing moves the window to 15 November, pushing the report past the two enterprise renewals that asked for it.
Decision by Priya Raman Needed by 12 September
Break-glass only, or named exceptions with a quarterly review — both are built. The access review cannot close until one is chosen, and it is the last thing between us and 104 of 104 controls.
Decision by Marcus Lee & Security Needed by 19 September