Project status · week 37

Synthetic extended title for an unusually complex cross-functional operating review, including multiple regions, jointly accountable teams, a revised delivery window and the full descriptive name without any ellipsis

Owner
Priya Raman
Reported
8 Sep 2026
Next review
15 Sep
Window opens
1 Nov 2026

At risk

Changed from On track

The penetration test is now the entire critical path. Our vendor cannot start before 6 October and the 10 October readiness assessment needs their report, so a two-week slip in the test is a two-week slip in the window. Everything else is on or ahead of schedule.

Since last week: evidence automation closed on 21 August and the access review passed 60%. The pen test moved from 22 September to 6 October when the vendor reassigned our team — that one change is why this is amber.

Needs a human

  1. 01

    Approve the second pen-test vendor, or accept the slip

    Decision by Synthetic jointly accountable owner with a very long full department name Needed by Synthetic jointly accountable owner with a very long full department name

    The second vendor can start 22 September for £9,400 more. Doing nothing moves the window to 15 November, pushing the report past the two enterprise renewals that asked for it.

  2. 02

    Sign off the standing-access model

    Decision by Marcus Lee & Security Needed by 19 September

    Break-glass only, or named exceptions with a quarterly review — both are built. The access review cannot close until one is chosen, and it is the last thing between us and 104 of 104 controls.

Milestones
3 of 7

complete · 1 in progress

Open blockers
3

1 needs a decision this week

Days to window
54

opens 1 November

Budget used
68%

£61K of £90K

Milestones

  1. 12 JUN

    Scope & control mapping

    Done
  2. 24 JUL

    Policy set approved

    Done
  3. 21 AUG

    Evidence automation

    Done
  4. 19 SEP

    Q3 access review

    In progress · 60%
  5. 6 OCT

    Penetration test

    At risk · slipped 14d
  6. 10 OCT

    Readiness assessment

    Planned
  7. 1 NOV

    Observation window opens

    Planned

Scope

Controls implemented87 / 104

84% · the remaining 17 are all access-related

Evidence collected automatically61 / 104

59% · target is 75 by the window opening

Policies approved22 / 22

100% · signed off 24 July, no changes since

Blockers

  1. Pen-test vendor cannot start before 6 October

    Blocking

    Owner Dana WhitfieldOpen 11 days Blocks 2 milestones

    Needs: approval to run the test with our second vendor at +£9,400, or a decision to move the observation window to 15 November.

  2. Nine engineers still hold standing production access

    Blocking

    Owner Marcus LeeOpen 4 days Blocks Q3 access review

    Needs: the standing-access model signed off. Break-glass tooling has been built and tested since 2 September — this is waiting on a decision, not on engineering.

  3. Two subprocessors have no countersigned DPA

    Watching

    Owner LegalOpen 23 days Blocks nothing yet

    Needs: countersignature from both vendors. Chased three times; escalate to their account teams if open on 22 September.