Look for a "Center for Effective IT adoption" in your state. These are private companies that have a grant from State Medicaid or from CMS to help docs with MU.
I contracted with an organization called MCEITA in Michigan: I paid them $200, the state kicked in another $5000 and they helped me tremendously: everything from the security analysis you mentioned to looking at my MU reports every 2 weeks and telling me "Ok doc, you are lacking in XY & Z and this is how you fix that in AC, until I was meeting all the criteria.
They were a godsend!
