We have a B2B Saas service which runs on Microsoft Azure. Microsoft publishes a lot of information about Azure security but occasionally customers ask us about the security testing and audits that have been performed on our own software - rather than Microsoft’s platform generally.
What good practice should we follow here? Is it enough to say we regularly have our systems tested by certified independent specialists? Or should we provide more detail - if so to what level?