Project status · week 37

SOC 2 Type II readiness

Owner
Priya Raman
Reported
8 Sep 2026
Next review
15 Sep
Window opens
1 Nov 2026

At risk

Changed from On track

The penetration test is now the entire critical path. Our vendor cannot start before 6 October and the 10 October readiness assessment needs their report, so a two-week slip in the test is a two-week slip in the window. Everything else is on or ahead of schedule.

Since last week: evidence automation closed on 21 August and the access review passed 60%. The pen test moved from 22 September to 6 October when the vendor reassigned our team — that one change is why this is amber.

Needs a human

  1. 01

    Approve the second pen-test vendor, or accept the slip

    Decision by Priya Raman Needed by 12 September

    The second vendor can start 22 September for £9,400 more. Doing nothing moves the window to 15 November, pushing the report past the two enterprise renewals that asked for it.

  2. 02

    Sign off the standing-access model

    Decision by Marcus Lee & Security Needed by 19 September

    Break-glass only, or named exceptions with a quarterly review — both are built. The access review cannot close until one is chosen, and it is the last thing between us and 104 of 104 controls.

  3. 03

    Approve the second pen-test vendor, or accept the slip

    Decision by Synthetic extended jointly accountable leadership and security review group Needed by 12 September

    The second vendor can start 22 September for £9,400 more. Doing nothing moves the window to 15 November, pushing the report past the two enterprise renewals that asked for it.

  4. 04

    Sign off the standing-access model

    Decision by Synthetic extended jointly accountable leadership and security review group Needed by 19 September

    Break-glass only, or named exceptions with a quarterly review — both are built. The access review cannot close until one is chosen, and it is the last thing between us and 104 of 104 controls.

  5. 05

    Approve the second pen-test vendor, or accept the slip

    Decision by Synthetic extended jointly accountable leadership and security review group Needed by 12 September

    The second vendor can start 22 September for £9,400 more. Doing nothing moves the window to 15 November, pushing the report past the two enterprise renewals that asked for it.

  6. 06

    Sign off the standing-access model

    Decision by Synthetic extended jointly accountable leadership and security review group Needed by 19 September

    Break-glass only, or named exceptions with a quarterly review — both are built. The access review cannot close until one is chosen, and it is the last thing between us and 104 of 104 controls.

Milestones
3 of 7

complete · 1 in progress

Open blockers
3

1 needs a decision this week

Days to window
54

opens 1 November

Budget used
68%

£61K of £90K

Milestones

  1. 12 JUN

    Scope & control mapping

    Done
  2. 24 JUL

    Policy set approved

    Done
  3. 21 AUG

    Evidence automation

    Done
  4. 19 SEP

    Q3 access review

    In progress · 60%
  5. 6 OCT

    Penetration test

    At risk · slipped 14d
  6. 10 OCT

    Readiness assessment

    Planned
  7. 1 NOV

    Observation window opens

    Planned
  8. 12 JUN

    Synthetic repeated milestone 8 with a multi-line description spanning several accountable workstreams

    Done
  9. 24 JUL

    Synthetic repeated milestone 9 with a multi-line description spanning several accountable workstreams

    Done
  10. 21 AUG

    Synthetic repeated milestone 10 with a multi-line description spanning several accountable workstreams

    Done
  11. 19 SEP

    Synthetic repeated milestone 11 with a multi-line description spanning several accountable workstreams

    In progress · 60%
  12. 6 OCT

    Synthetic repeated milestone 12 with a multi-line description spanning several accountable workstreams

    At risk · slipped 14d

Scope

Controls implemented87 / 104

84% · the remaining 17 are all access-related

Evidence collected automatically61 / 104

59% · target is 75 by the window opening

Policies approved22 / 22

100% · signed off 24 July, no changes since

Blockers

  1. Pen-test vendor cannot start before 6 October

    Blocking

    Owner Dana WhitfieldOpen 11 days Blocks 2 milestones

    Needs: approval to run the test with our second vendor at +£9,400, or a decision to move the observation window to 15 November.

  2. Nine engineers still hold standing production access

    Blocking

    Owner Marcus LeeOpen 4 days Blocks Q3 access review

    Needs: the standing-access model signed off. Break-glass tooling has been built and tested since 2 September — this is waiting on a decision, not on engineering.

  3. Two subprocessors have no countersigned DPA

    Watching

    Owner LegalOpen 23 days Blocks nothing yet

    Needs: countersignature from both vendors. Chased three times; escalate to their account teams if open on 22 September.