include conducting a review of physical security, reviewing processes and conducting simulated attacks on infrastructure services (system-level penetration test) and application services (application-level penetration test).