IMO these are basically the same thing or at least dovetail into one another. I propose merging these subsections in some logical way and referring to them as a Security Concept Review. This would hopefully avoid confusion while reducing our service offerings from 3 to 2.
