Businesses have to collect information about their clients, and clients often want assurance that their information is secure. What is the accepted way to concisely and clearly communicate how secure the systems are that are transmitting and storing the client's data? From what I can tell, it sounds like citing compliance with a security standard (such as ISO27001) is the way to go when speaking with a security professional (is that correct?), but does anyone have any experience with successfully explaining "how secure" your system is to a "lay" person with little-to-no understanding of information security? Just "Our business meets or exceeds the accepted security standards for our industry"? Is that enough information? In your experience, how much detail do most people want?
Background information: our business collects sensitive data about our clients as part of an accreditation process for services they want to qualify for with a third party. Most of these clients are small business owners, e.g. plumbers, dentists, restaurant owners, etc.
This question might be subjective, but it falls into the realm of "good subjective."
This is a not a duplicate of How to get top management support for security projects?. That post deals with communicating with others within your organization, while this question is about communicating with people outside your organization, which is much more sensitive. You can explain to a superior why your system isn't "100% secure", but you have to be more diplomatic with a client, while still being concise.