Security obligated points to include in a website implementation proposal

Question

What are the security topics that you should always include when writing a proposal for a website implementation?

Answer 1

You may find good material at the Open Security Architecture site.

I would start with Identity, Authentication and Authorisation, probably also include Audit trails too (perhaps overkill for some sites, but you do need know if you need to consider them and if not explicit discount them).

Another direction is to consider threats. For example Denial Of Service.