Q

How much info should an ASP give potential customers about its security policies?

As an ASP, our company gets requests from prospective customers to provide them with our security policies and/or

to fill out lengthy security questionnaires.

While I respect their request and need to know, how much information is too much? Is there industry information (i.e., surveys, etc.) that identifies what type of security information is safe to provide to external entities?

In this case, as a prospect, they are governed by an NDA, but they have the information regardless of whether they choose to be a customer or not.

Thanks in advance for your help!


Having previously worked for an ASP as a Chief Security Officer, I understand your dilemma. While there, I created two separate security policies, one for internal use detailed our corporate policies and a second, less detailed policy, that gave prospective customers an understanding of our security infrastructure. The external security policy provided enough information to prove we were serious about security, but not enough information to give away any important details. Corio provides an interesting example.


For more information on this topic, visit these other SearchSecurity resources:
Best Web Links: Outsourcing


This was first published in April 2002

Dig deeper on Secure SaaS: Cloud services and systems

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close