When a client asks if they are secure, they are rarely asking about your firewall. They are asking whether they are covered and whether you can prove you did your job. Here is how to answer.