How To Answer A Client Asking For A Security Certificate

A website framework does not establish compliance

You have a good client, and their security team has asked for a certificate. Here is the uncomfortable part you need to know before you reply.

Choosing static pages can simplify part of a website. It does not demonstrate that a business meets every customer security requirement or has completed an independent assessment.

The AICPA overview of SOC services describes reporting on organisational controls. Treat these requirements as an organisational question, not a badge supplied by a website framework.

This matters because a client that asked for a certificate and then discovers the answer was optimistic is far more damaging to your reputation than the delay a careful answer would have caused.

Document what the website actually does

List the information collected through forms, the services receiving it, who has account access, and which parts of the site involve customer records or payments. A brochure site and an application handling private records need different reviews.

Avoid claiming that static pages automatically exclude every connected service from an assessment. A form, payment integration or analytics service can introduce its own information flows and responsibilities.

Prepare useful evidence

For a website project, useful records include configuration, access ownership, update procedures, test results and the recovery process. These describe implemented work. They do not replace an assessment by the people responsible for your organisation’s requirements.

Agree the scope before development

If a buyer requires a particular review or report, share the requirement before the project starts. Identify the responsible specialist, documents needed and costs outside ordinary website design. Do not rely on a general promise of “bank-grade security”.

OWASP’s security guidance provides a starting point for technical risk discussions. The controls selected still need testing and ongoing ownership.

What to reply with

Send a short written answer rather than a brochure. It should state what data the site handles, who can access it, how access is protected, and which connected services are outside your control. Say plainly that an independent assessment is a separate engagement with a separate cost.

A precise answer that admits a boundary is more credible than a confident one that claims everything, and it keeps the relationship intact.