Includes firms engaged in auditing the organizations’ compliance with the standards and documented procedures that identify risks and vulnerabilities within the existing IT environment, also, conducting penetration testing to the established security measure for possible breaches and the exploitable vulnerabilities that an attacker might gain unauthorized access.