- main:
  - text: Project status · week 37
  - heading "SOC 2 Type II readiness" [level=1]
  - term: Owner
  - definition: Priya Raman
  - term: Reported
  - definition: 8 Sep 2026
  - term: Next review
  - definition: 15 Sep
  - term: Window opens
  - definition: 1 Nov 2026
  - region "At risk":
    - heading "At risk" [level=2]
    - text: Changed from On track
    - paragraph: The penetration test is now the entire critical path. Our vendor cannot start before 6 October and the 10 October readiness assessment needs their report, so a two-week slip in the test is a two-week slip in the window. Everything else is on or ahead of schedule.
    - paragraph: "Since last week: evidence automation closed on 21 August and the access review passed 60%. The pen test moved from 22 September to 6 October when the vendor reassigned our team — that one change is why this is amber."
  - region "Needs a human":
    - heading "Needs a human" [level=2]
    - list:
      - listitem:
        - text: "01"
        - heading "Approve the second pen-test vendor, or accept the slip" [level=3]
        - paragraph: Decision by Priya Raman Needed by 12 September
        - paragraph: The second vendor can start 22 September for £9,400 more. Doing nothing moves the window to 15 November, pushing the report past the two enterprise renewals that asked for it.
      - listitem:
        - text: "02"
        - heading "Sign off the standing-access model" [level=3]
        - paragraph: Decision by Marcus Lee & Security Needed by 19 September
        - paragraph: Break-glass only, or named exceptions with a quarterly review — both are built. The access review cannot close until one is chosen, and it is the last thing between us and 104 of 104 controls.
  - term: Milestones
  - definition: 3 of 7
  - paragraph: complete · 1 in progress
  - term: Open blockers
  - definition: "3"
  - paragraph: 1 needs a decision this week
  - term: Days to window
  - definition: "54"
  - paragraph: opens 1 November
  - term: Budget used
  - definition: 68%
  - paragraph: £61K of £90K
  - region "Milestones":
    - heading "Milestones" [level=2]
    - list:
      - listitem:
        - text: 12 JUN
        - heading "Scope & control mapping" [level=3]
        - text: Done
      - listitem:
        - text: 24 JUL
        - heading "Policy set approved" [level=3]
        - text: Done
      - listitem:
        - text: 21 AUG
        - heading "Evidence automation" [level=3]
        - text: Done
      - listitem:
        - text: 19 SEP
        - heading "Q3 access review" [level=3]
        - text: In progress · 60%
      - listitem:
        - text: 6 OCT
        - heading "Penetration test" [level=3]
        - text: At risk · slipped 14d
      - listitem:
        - text: 10 OCT
        - heading "Readiness assessment" [level=3]
        - text: Planned
      - listitem:
        - text: 1 NOV
        - heading "Observation window opens" [level=3]
        - text: Planned
  - region "Scope":
    - heading "Scope" [level=2]
    - paragraph: Controls implemented 87 / 104
    - paragraph
    - paragraph: 84% · the remaining 17 are all access-related
    - paragraph: Evidence collected automatically 61 / 104
    - paragraph
    - paragraph: 59% · target is 75 by the window opening
    - paragraph: Policies approved 22 / 22
    - paragraph
    - paragraph: 100% · signed off 24 July, no changes since
  - region "Blockers":
    - heading "Blockers" [level=2]
    - list:
      - listitem:
        - heading "Pen-test vendor cannot start before 6 October" [level=3]
        - text: Blocking
        - paragraph: Owner Dana Whitfield Open 11 days Blocks 2 milestones
        - paragraph: "Needs: approval to run the test with our second vendor at +£9,400, or a decision to move the observation window to 15 November."
      - listitem:
        - heading "Nine engineers still hold standing production access" [level=3]
        - text: Blocking
        - paragraph: Owner Marcus Lee Open 4 days Blocks Q3 access review
        - paragraph: "Needs: the standing-access model signed off. Break-glass tooling has been built and tested since 2 September — this is waiting on a decision, not on engineering."
      - listitem:
        - heading "Two subprocessors have no countersigned DPA" [level=3]
        - text: Watching
        - paragraph: Owner Legal Open 23 days Blocks nothing yet
        - paragraph: "Needs: countersignature from both vendors. Chased three times; escalate to their account teams if open on 22 September."
  - text: Compiled 8 September 2026, 07:00 UTC from the compliance tracker, the access-review export and the project ledger. Milestone dates are committed dates, not forecasts; budget is spend to date against the approved £90,000.