There's a very recently announced (https://security.googleblog.com/2021/10/launching-collaborat...) initiative by Google, Salesforce, Okta, Slack and others to create a minimal security standard - https://mvsp.dev/ - which will hopefully reduce this overhead and encourage an improvement in security across the industry.
The name still makes me giggle. I'd love to build something relevant and silly enough to put there, but I haven't found it yet.
Suggestions are welcome! :)