What happens during a security review?

The security review process includes two kinds of assessments:

• Qualitative—question and answer round-to-review policies and procedures
• Quantitative—network and application penetration tests (see Scope)