Letter to the client

July 7, 2010

Dear Client,

I know you have reservations about going through an assessment so I propose a mutual commitment of things we can both do to make this process as  painless as possible:

You agree to do the following:

  1. Gather as many of the policies, procedures, and supporting documentation available before I arrive.  In other words, if you say you do something, be able to provide some sort of evidence that it is being done.
  2. Schedule  interviews with the people who “do” the actual work, not the managers that think they know what’s happening down in the trenches.  I’m sure you think you know what is supposed to occur, but in the interest of not wasting our time, I’d prefer to speak with those that actually do the work.
  3. Identify your environment.  Make sure there is an updated network diagram and a matrix detailing all of the systems that deal with sensitive information.  For example, during the assessment is not the time to discover the backup of the production database under the receptionist’s desk, which was replicated “just in case.”

I agree to do the following:

  1. I will not be your enemy.  My goal is not to publicly humiliate you or your staff.  The goal is to work together to identify any gaps in your infosec program in order to make it better.
  2. I will not know everything there is to know. I encourage you to “push back” if you do not agree with anything I say or find.  I welcome conversation as it better helps me understand your environment.
  3. I will not ask “trick questions.” If you want to mislead me, then that is on you.  I am going to ask you what I need and want to know.

An assessment can be a learning experience and by agreeing to the terms listed above you can expect the same courtesy in return.  As this can help in easing the pain that is….A security assessment.

Disclaimer: I do not speak for all infosec assessors, neither good nor bad.  These are my own thoughts based on my own experiences.

11 Responses to “Letter to the client”

  1. shrdlu said

    Very nice start! Congratulations! And you sound so much more reasonable than I do …

  2. newfurniturey said

    Great start! It’s straight-forward, cuts out all of the in-between and gets right to what is needed. I definitely agree with each of the points you noted and though there is always room for “more” I think you listed the most important things that should be listed and should keep it “as is” – and should be a default letter that goes out to all clients.


  3. As I’ve tweeted and blogged, nice job! I look forward to what you bring us in the future.

    Kevin (@kriggins)

  4. bonarez said

    Nice start indeed! I like your mindset.

    One thing I would add. Always agree on the scope of your assessment before you dive in. As divers say: plan the dive, dive the plan!

  5. Aditya said

    Good one,

    Really liked it!

  6. Tim said

    Great blog –

    Very clear and precise – honesty is key and if they have known issues it is better to tell you then to have it become an public incident.


  7. Great post. I look forward to more.

  8. […] of mine started a new blog, Fear Not the Assessor.  She started it off with an excellent post, Letter to the Client.  Almost every QSA goes into a new client with a certain sense of trepidation due to […]

  9. […] Letter to the client « Fear Not the Assessor […]

  10. Luza said

    Interesting letter, it should be used in any security assessment as the first step to prepare the environment so the assessment can be a nice experience for both parties.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: