Drupal Security Updates - boilerplate explanation and justification documents

We are dealing with a new client right now, an agency that is working with a restaurant. The retaurant site has not been updated since 7.12! The agency is asking for some documentation to share with the client about the need for these updates.

I did a simple google search, and came up with no usable results! Maybe Drupal.org has some resources, but I have never seen anything like that there.

This would be a really valuable resource for everyone working with clients. I'm really surprised we as Drupal users are not sharing some of this.

So we are in a time crunch now. Does anyone have something to share that we could use? You can send it to me privately, and I can edit out your client specifics, and show you what we will send to our client. (Bonus - I WILL be posting this to Drupal.org documentation, so you would be helping with community building too!)

If someone knows of other resources, please share! Thanks.