Provide security posture of governance and policy. Provide in-depth risk analysis of logical and physical controls around a custom piece of software or vendor procured. Provide guidance for industry standards for compliance; ie. ISO 27001, NIST, SOX, etc...