I remember when I first saw these sorts of things becoming commonplace and I wondered "who believes this stuff?". Well apparently everyone because instead of go

I remember when I first saw these sorts of things becoming commonplace and I wondered "who believes this stuff?". Well apparently everyone because instead of going away they've exploded. There are hundreds of companies that have these sorts of seals and they guarantee almost nothing. The best outcome for most of them is that they've reviewed your business practices and documentation and you conform with some sort of sanity check. Thats kinda what the ISO certifications are about, and a fair amount of what PCI/etc were about. For the most part though, the PCI certification was arbitrary at best, but required if you wanted to process credit cards/etc. There are still plenty of places that pass PCI style audits, but you'd never want to have your credit card number pass through. The "scan" business is also interesting because it also doesn't really prove much, other than you might have a firewall or some sort of packet filter. Which is good, but not really great, but better than zero :)