I am having a hard time making up the infrastructure of a company to assess the "made up" security and then give recommendations.

I'm not sure if I have over analyzed this, but I could use a jump start to get ideas flowing. Thanks