ARCHITECTURE AND PROJECT INTAKE FORM

Project Intake · Data Scope · Threat Modeling Trigger · Review Routing

Table of Contents

1. Purpose and Use
2. Template Instructions
3. Fill-In Template
4. Review and Approval
5. Document Control

1. Purpose and Use

This form is the front-door intake artifact for the architecture review procedure. It captures enough information to route a project to the correct CERG review path, trigger threat modeling when needed, and identify data, vendor, regulatory, and deployment scope early.

This template does not replace the full architecture review record, threat model, pre-production security review, production handoff package, or go-live risk acceptance packet defined in CERG-PRC-AR-001 §§6-9. A completed intake form opens and routes the engagement; later procedure records close it.

The Intake Form Is the Front Door

Projects should not discover security requirements at the end. Intake is where ownership, data, architecture, vendors, identity, logging, and deployment risk become visible early enough to matter. Approval of this intake confirms routing, not production readiness or risk acceptance.

2. Template Instructions

1. Copy this template before use.
2. Replace every bracketed field with case-specific information.
3. Do not delete fields that appear not applicable. Mark them Not Applicable and explain why.
4. Use canonical CERG role names from CERG-GOV-OM-001.
5. Use the completed form to record scope determination, review path, and required follow-on artifacts.
6. Do not use the completed form as evidence of architecture approval, pre-production readiness, go-live authorization, or risk acceptance.
7. Link later risks, findings, exceptions, evidence, and approvals to the system of record.
8. Store the completed artifact in the evidence library governed by CERG-PRC-AUD-001.

3. Fill-In Template

3.1 Project Summary

3.2 Scope and Data

3.3 Architecture and Control Triggers

3.4 Review Routing

3.5 Intake Disposition and Follow-On Records

3.6 Business Decision Box

4. Review and Approval

Reviewer signatures on this form confirm intake routing and required follow-on records only. Production readiness, go-live authorization, and risk acceptance are documented through the Phase 4 and Phase 5 records governed by CERG-PRC-AR-001.

Completed templates are reviewed at the cadence defined by their parent procedure or plan. Material changes require a new review.

5. Document Control

Revision History

Review Triggers

• Parent procedure or plan change
• Audit, assessment, or tabletop finding related to this template
• Role or approval model change
• Direction from the CISO

Related Documents

Source: templates/CERG-TMPL-AR-001_Architecture_and_Project_Intake_Form.md · Download .md · View on GitHub