Why don't you look into ISO 17799 and its accompanying certification (ISO/IEC 27002)? I don't know about the certification, but I did read the equivalent UK sta

Why don't you look into ISO 17799 and its accompanying certification (ISO/IEC 27002)? I don't know about the certification, but I did read the equivalent UK standard (BS 27002) a while back and found it quite reasonable. It will surely help you with client reassurance and also clarify your thinking.