Their checklist consists of (1) evaluating topology, (2) penetration testing from outside and inside network, (3) evaluating network devices, such as routers, switches, firewalls, IDS, (4) evaluating servers, (5) evaluating applications, and (6) evaluating policy and procedures.