Comment by richm44

You can't get perfection, but you can do things like ask for them to document the controls they implement and to evidence that they have operated them appropriately via an audit like SOC2.