Problem solve
Get help with specific problems with your technologies, process and projects.
How much info should an ASP give potential customers about its security policies?
As an ASP, our company gets requests from prospective customers to provide them with our security policies and/or to fill out lengthy security questionnaires.
While I respect their request and need to know, how much information is too much? Is there industry information (i.e., surveys, etc.) that identifies what type of security information is safe to provide to external entities?
In this case, as a prospect, they are governed by an NDA, but they have the information regardless of whether they choose to be a customer or not.
Thanks in advance for your help!
Having previously worked for an ASP as a Chief Security Officer, I understand your dilemma. While there, I created two separate security policies, one for internal use detailed our corporate policies and a second, less detailed policy, that gave prospective customers an understanding of our security infrastructure. The external security policy provided enough information to prove we were serious about security, but not enough information to give away any important details. Corio provides an interesting example.
For more information on this topic, visit these other SearchSecurity resources:
Best Web Links: Outsourcing
This was last published in April 2002
Dig Deeper on Secure SaaS: Cloud application security
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.
Meet all of our Information Security experts
Start the conversation
0 comments