This is an advisory review based on information you provide. Penetration testing, vulnerability scanning, incident response, implementation, and compliance certification are outside this package. Any system access requires explicit authorization and an agreed scope.