I am building a hosted (SaaS) web application that stores PII like name, email address, and employer of the user. As of right now, I don't intend to ever store credit card numbers or bank account numbers or social security #'s, etc.
I would like to be able to claim that my service follows "industry standard" security practices, but I am a bit unclear what this means today. For example, is a password hashed by SHA-1 or MD5 that is properly salted still considered industry standard and acceptable?
In general, what guidelines do people follow to determine "industry standard" practices from all angles so 1) you are adequately protected from malicious activities and 2) won't get hammered in court if you ever get sued over a data leak.
Also, how does this change if you store more sensitive PII like a social security #?