said by AkFubar:
Security is a broad term but usually it can mean the person expects the ISP's network to be secure (free of threats) for email and the connection in general. Likely also means does the ISP have documented measures taken to ensure security, does the ISP have a process for dealing with active threats, does the ISP have a back up plan if things go down, etc.
It's best to get some some clarity on exactly what the employer's expectations are.
But try to be as dumb a pipe as Rogers/Bell residential services.
You DON'T want to be in the business of "managed networks" unless you are getting paid BIG bux.
Tell them that they need to supply their own security appliances at each end, own VPN software, own security suites, own OS & application patch management, own security training, if what they want is a $40/month connection from you.