The attached PDF is an automatically generated report. You can get something like that for £5-10k if you go through one of the typical audit firms (KPMG, Deloi

The attached PDF is an automatically generated report. You can get something like that for £5-10k if you go through one of the typical audit firms (KPMG, Deloitte and co). In addition you can look into some ISO certifications or industry specific regulations. It's basically a checklist of a thousand questions: do you use TLS? are your applications protected by authentication? can custom folks access personal data of customers? are there audit logs of support accessing customer information?