Does NGCYBIT describe security reviews?

Direct answer

Company communications refer to regular security reviews. Ask for the scope and current supporting information when seeking details about a particular review.