Following are scope of work:-
1) Risk Profiling & Design Review
2) Application Code Review
3) Web/application Server Security Assessment including patches and updates, detailed configuration review & auditing and logging module review.
4) Database Security Assessment,
5) Application Security Assessment including application walkthrough,
6) Deployment Architecture Review
7) Process:-user & change management , backup process etc.