Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Background: our company provides an online service. The service is provided both to general public, and to enterprise customers. Enterprise customers are signed on as part of sales efforts. We have encountered one customer (in Japan), who requires us to be audited for security. That's pretty much all the have requested, though, i.e. they do not ask for any specific standard, or identified any companies that they would prefer to be used.

Question: considering that I'm completely ignorant in standards in this area, who should I try turning to at all? Is there a good standard of certification of a particular application deployment, that is widely accepted? If I at least knew that, it would probably be easier to Google a company that would do such an audit, but any name suggestions would be also appreciated.

share|improve this question

You can get several things, if they need Assurance, you will need to get something along the ISAE3402. If you need pure security, you can hire a company that performs Attack and Penetration testing. There are several companies that perform this service, some more reputable than others. Most of the big 4 (Ernst & Young (<== My shop) , KPMG, PriceWaterhouseCoopers or Deloitte) perform these services and are in general, globally accepted. Consult with your client if they have a preferred company.

Just make sure that your client is clear what they want, because pure A&P reports are often not accepted for Assurance.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.