Compliance and Risk management is not a one-time effort, but a continuous process.  There are many companies in the JDE space that will provide security assessments or audits and offer plans to remediate, but once the project is over, their work is done.  However, YOUR work is not done.  You need a partner that will start at the beginning with identification, analysis and assessment of the risks before you get to the point of planning the remediation efforts.  Even when the remediation is complete, you need to then review the results, and start the process again.