I believe that they actually meant more like NIST/FIPS compliance type stuff so that big orgs that have to meet certain certifications will know if they can use

I believe that they actually meant more like NIST/FIPS compliance type stuff so that big orgs that have to meet certain certifications will know if they can use your product or not. EDIT: for example: https://auth0.com/security https://auth0.com/security. SOC 2 is a big one.