Request a technical and research audit for your web site to learn whatever they Believe must be carried out, why, and exactly what the expected consequence need to be. You will likely have to pay for this. You'll likely have to give them read through-only entry to your site on https://rsac.org