Who should I use for auditing/cerifying server software or specific deployment

Question

Background: our company provides an online service. The service is provided both to general public, and to enterprise customers. Enterprise customers are signed on as part of sales efforts. We have encountered one customer (in Japan), who requires us to be audited for security. That's pretty much all the have requested, though, i.e. they do not ask for any specific standard, or identified any companies that they would prefer to be used.

Question: considering that I'm completely ignorant in standards in this area, who should I try turning to at all? Is there a good standard of certification of a particular application deployment, that is widely accepted? If I at least knew that, it would probably be easier to Google a company that would do such an audit, but any name suggestions would be also appreciated.

Answer 1

You can get several things, if they need Assurance, you will need to get something along the ISAE3402. If you need pure security, you can hire a company that performs Attack and Penetration testing. There are several companies that perform this service, some more reputable than others. Most of the big 4 (Ernst & Young (<== My shop) , KPMG, PriceWaterhouseCoopers or Deloitte) perform these services and are in general, globally accepted. Consult with your client if they have a preferred company.

Just make sure that your client is clear what they want, because pure A&P reports are often not accepted for Assurance.