I started a small business that provides a web application to clients, and a new customer asked for a security plan. I've never written one before.
I understand that security plans can vary in breadth and depth, depending on the service provided and the customer's needs. For my case, we are a small shop with a fairly simple CRUD web app, and the size of the contract is ~$10K, which is for a local municipality.
I can write something up to let them know that we are using an up to date web framework/SSL/database/VPN's, and that we are monitoring all services and user-generated content.
What are some best practices that can assist me?
How can I interpret the customer's needs in their request?
Updates:
- renamed "security profile" to "security plan" for better clarity.
- emphasized that I am looking for examples of software security plans, and guides to these plans, instead of just responding with an email.
- emphasized that I am looking for a guide or example of how to write a SaaS security plan, which fits the common pattern of a web application backed by a database.
- Updated with the Software Security Plan that I found here: http://sunguidesoftware.com/sunguidesoftware/documentlibrary/ReadingRoom/ProjectDocuments/Process%20Document%20-%2015809/SunGuideSMD-SSP-1%200%200(WorkingFinal).pdf but it's for a traffic surveillance system, which is quite different than a web application...