You likely have exposure to several consulting companies other than just your own (via NCC if nothing else), but how is this usually dealt with in the security

You likely have exposure to several consulting companies other than just your own (via NCC if nothing else), but how is this usually dealt with in the security consulting industry? I have had a few clients request my credit reports to do assessments. Do consulting companies typically bend over for those? I declined, but it was pretty clear that most or all consultants they talked to in the past agreed to it, and I was the exception. For what it's worth, this client had nothing to do with finance or national security, and there would be no PII involved. Amusingly, the largest of clients I've worked with and the most sensitive information and IP I've handled never involved anything beyond an NDA.