# 2. Which requirements should be mandatory gates?

**Use gates for conditions the organisation cannot sensibly trade away.** Apply the gates below to the first-release scope and approved risk appetite, not indiscriminately to every possible use case.

- **Pass:** the agreed condition is evidenced and accepted.
- **Hold:** evidence, remediation or contractual agreement remains outstanding.
- **Fail:** the proposal cannot meet the condition within the accepted scope and constraints.

A hold is not a pass. A failed proposal may be reconsidered after a documented change and retest; do not waive the failure by increasing its weighted score.

| Gate | Required evidence for a pass | Accountable sign-off |
|---|---|---|
| **G1. Security and permission boundaries** | Approved access design; demonstrated role restrictions across records, attachments, search, reporting, exports and enabled AI; acceptable identity and privileged-access arrangements | CISO / security architecture |
| **G2. Supplier assurance and applicable contractual duties** | Risk-based supplier review; acceptable assurance evidence, recovery arrangements, data-processing terms, subprocessors and applicable sector agreements | Third-party risk, legal and privacy |
| **G3. Essential workflows and assurance separation** | Every designated launch-critical workflow passes; required approval and challenge rights cannot be bypassed through ordinary user actions | Process owners; internal audit where relevant |
| **G4. Information preservation and retrieval** | Agreed records, evidence, relationships and required history survive migration or remain in an approved archive; representative retrieval and export tests pass | Data owner, records management and audit |
| **G5. Deliverability and operating capacity** | Named buyer and supplier owners; credible dependencies and acceptance plan; funded administration and support after handover | Sponsor and programme lead |
| **G6. Affordable, defined commercial scope** | Required modules, users, interfaces and services are priced; base and downside exposure are within approved limits; no material unpriced dependency | Finance and procurement |
| **G7. Safe AI deployment, if enabled** | Approved data handling and model arrangements; permission tests pass; consequential actions require agreed human authority; disablement works | CISO and AI/model-risk owner |

For G2, do not equate the existence of an assurance report with adequate assurance. Banking guidance specifically calls for considering whether the scope and results of SOC reports or other assessments are relevant to the activity being outsourced. ([federalreserve.gov](https://www.federalreserve.gov/supervisionreg/srletters/SR2304.pdf))

### How should sector requirements change the gates?

**Establish applicability with the buyer’s legal, compliance and assurance specialists.** The following are prompts, not a complete regulatory mapping.

| Buyer context | Source-backed consideration | Proposed evaluation consequence |
|---|---|---|
| US banking organisation | The agencies’ community-bank guide addresses resources, transition capability, termination costs and data inventories. ([federalreserve.gov](https://www.federalreserve.gov/publications/files/third-party-risk-management-guide-20240503.pdf)) | Test the GRC supplier as a third party, including continuity and exit—not only its third-party-risk module |
| HIPAA-regulated organisation placing ePHI in the service | HHS states that a cloud provider creating, receiving, maintaining or transmitting ePHI on the organisation’s behalf is a business associate, including when it cannot decrypt the information. A compliant BAA is required in that situation. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html)) | Determine whether ePHI is actually needed; if it is, validate the applicable BAA and service scope before uploading it |
| NYDFS-covered entity | NYDFS’s 21 October 2025 guidance addresses third-party selection, contracting, monitoring and termination; it clarifies existing requirements and recommends practices rather than imposing new obligations. ([dfs.ny.gov](https://www.dfs.ny.gov/industry-guidance/industry-letters/il20251021-guidance-managing-risks-third-party)) | Separate applicable requirements from recommended contract protections and document any accepted gaps |
| Internal-audit-led programme | The IIA’s Standard 7.1 addresses organisational independence and safeguards against impairment. ([theiia.org](https://www.theiia.org/globalassets/site/standards/globalinternalauditstandards_2024january9.pdf)) | Have internal audit approve the proposed division of management, assurance and administrator powers |

Do not turn “US-focused” into an automatic claim that every buyer is legally required to use US-only hosting. HHS’s cloud guidance, for example, discusses overseas processing as a risk-analysis consideration rather than imposing a blanket domestic-hosting requirement. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html))