Ask the Expert

How much info should an ASP give potential customers about its security policies?

As an ASP, our company gets requests from prospective customers to provide them with our security policies and/or to fill out lengthy security questionnaires.

While I respect their request and need to know, how much information is too much? Is there industry information (i.e., surveys, etc.) that identifies what type of security information is safe to provide to external entities?

In this case, as a prospect, they are governed by an NDA, but they have the information regardless of whether they choose to be a customer or not.

Thanks in advance for your help!

    Requires Free Membership to View

Having previously worked for an ASP as a Chief Security Officer, I understand your dilemma. While there, I created two separate security policies, one for internal use detailed our corporate policies and a second, less detailed policy, that gave prospective customers an understanding of our security infrastructure. The external security policy provided enough information to prove we were serious about security, but not enough information to give away any important details. Corio provides an interesting example.

For more information on this topic, visit these other SearchSecurity resources:
Best Web Links: Outsourcing

This was first published in April 2002

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: