08

Open questions

  1. Q1 Is a signed BAA required for the marketing site? Selects the build tier and the procurement route. No PHI on sdata.us argues no, but the reviewer decides. Owner: Allison.
  2. Q2 Standard or Hardened? $120/yr apart. Recommendation is Hardened, on security grounds rather than cost. Owner: Patrick.
  3. Q3 Whose GitHub organisation owns the repository? It should be SmartData's, with PreHealth as collaborators, and branch protection on from the first commit. Anything else and total control has not actually been delivered. Free to get right at the start, awkward to change later.
  4. Q4 Who publishes, and how often? Sets the CMS seat count and decides how much the Storyblok demo matters. Owner: Chrissy.
  5. Q5 Is a design refresh in scope, or parity only? Parity is 260–320 hours. A refresh is 400–520. Recommendation is to keep them separate so the security work is not gated on design approval.
  6. Q6 Who owns the security posture after handover? Headers and WAF rules need a named owner and a review cadence, or they drift. Phase 06 delivers the runbook; someone has to hold it.

Next steps

ActionOwnerStatus
Answer Q1 — BAA requirementAllisonOpen. Blocks the build tier and the final cost.
File vendor trust-document access requestsJohnURLs and attestation lists on the Trust documentation page.
Confirm Standard vs HardenedPatrickRecommendation: Hardened. See Build options.
Stack overview and level-of-effort to April and JayJohnSections 07 and 08 — inventory, phases, hours, calendar.
CMS options and editor-experience gaps to Jay and AprilJohnSee Editor tradeoff. Add the Storyblok demo to the agenda.
Cost comparison for the decision callJohnSubscriptions page — annual software cost by build option.
Confirm repository ownershipApril, ChrissyOpen. Q3.
Schedule the decision callApril, ChrissyOpen.
Remove /home---with-window from the live sitemapPreHealthIndependent of this decision. Worth doing this week.