You can act on the report yourself, bring in somebody else, or have the fixes done here. All three are normal.
If you want the work done, it is quoted from what the report actually found. No work starts until you approve a scope in writing, with the price for each item in it.
Ongoing support exists, and it is described in writing before it begins: what is included, what is not, the limits of it, and how fast you can expect an answer. The written terms come first, so nothing is assumed. If a support arrangement does not suit how you work, the checkup and the report still stand on their own.