If someone claims to support industry standards (or best practices), just ask which standard. Is it, for example NIST 800-63B ( https://pages.nist.gov/800-63-3/

If someone claims to support industry standards (or best practices), just ask which standard. Is it, for example NIST 800-63B ( https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html )? Of course, they aren't really following any standard or best practice -- but it will be tough to get them to admit that.