Blog · Security overview · Problem 6 of 93
The customer asked for a security overview. You have a paragraph on the website.
· 3 min read · By Case Jones
A buyer, or their procurement team, wants a document or page that explains how you protect their data before they even send a questionnaire. Your website has one line about “bank-level security” and nothing else.
What it costs to leave it
Without an overview, every buyer sends a full questionnaire and each deal waits on it. A vague or inflated page is worse: buyers compare it with your questionnaire answers, and claims you cannot back up become questions you have to answer.
How to write an overview buyers trust
A good overview is short, specific and true. It answers the questions every buyer asks first, and points to where they can get more.
- 1
Start with what data you hold and where
Say what kinds of customer data you store, which cloud provider and region hosts it, and who your main subprocessors are. Buyers ask this first because it decides which of their rules apply.
- 2
Cover the areas every buyer checks
Access control and MFA, encryption in transit and at rest, backups, incident response, employee onboarding and training, and vendor reviews. One to three plain sentences each.
- 3
Only claim what your policies say
Every sentence on the page should match a written policy and what the team actually does. If a policy says reviews are quarterly, the page cannot say monthly. Check before you publish.
- 4
Say what you don’t have yet
If you are not SOC 2 audited, do not hint that you are. Saying “We are preparing for a SOC 2 audit” is honest and common. Buyers trust an overview more when it admits something.
- 5
Say how to ask for more, and keep it current
Give an email for security questions and say what you can share under an NDA, such as policies or a filled questionnaire. Put a “last updated” date on the page and review it whenever a policy changes.
Example
One honest section
Access: Staff sign in to our systems with single sign-on and multi-factor authentication. Access is granted by role and removed on a person’s last day, using a checklist. We review who has access to production every quarter.
Or write the policies first, then the page
The policy builder works out which documents you need, and an AI policy assistant writes and customises them, researching as it writes. Your overview can then say only what your policies say.
The questionnaire check compares what your website claims with what your policies say, and shows where they disagree. Fix either the page or the practice before a buyer notices.
When a buyer wants more than the page, answer their questionnaire from the same policies. It is all free, with no card.
- The policies an overview should rest on
- Website claims checked against your policies
- Questionnaire answers from the same source
- Word downloads of every policy
Start my policies
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
What is the difference between a trust page and a security overview?
A trust page is usually public on your website. A security overview is often a document you send to buyers, sometimes under an NDA. The contents overlap; the overview can go into more detail.
Should we publish our policies?
Usually not in full. Summarize them on the page and share the documents with serious buyers under an NDA. Policies describe internal details you don’t need to give everyone.
Can we mention our cloud provider’s certifications?
Yes, as long as you are clear they are the provider’s, not yours. “Our data is hosted on AWS, which is SOC 2 audited” is accurate. “We are SOC 2 compliant because we use AWS” is not.
How long should it be?
One to two pages, or one screen per section on the web. Buyers read the overview to decide what to ask next, not instead of asking.