3 ms·
a) maybe they're not good clients for you, consider taking down their contact info and getting back to them when you're bigger b) save your answers, make a com
by dv_dt 3y ago
a) maybe they're not good clients for you, consider taking down their contact info and getting back to them when you're bigger
b) save your answers, make a common security practices document that you provide and ask the clients to get back to you with any gaps or questions
- the_bear 3y agoI think this is the right answer, and I especially want to call out the second part, because it can be a bit counterintuitive. The reason for having security documentation isnt so that it can answer the questions the client has. No one will actually read it. The thing is, people have an unlimited appetite for wasting your time if it's free for them to do so. By pointing them at documentation and having them get back to you with questions, you're now making it their problem instead of yours. Some clients will say no, fill out the questionnaire. You can politely bow out with those clients. Others will glance at your docs and decided it's not worth it to them to figure out if you actually answer all their questions, so they'll just check the "security review complete" box in their buying process.