Ask for a specialized and search audit for your site to find out the things they Assume needs to be carried out, why, and exactly what the expected outcome needs to be. You'll probably really need to purchase this. You will likely need to provide them with browse-only usage of https://rsac.org