Verifying a vendor who claims to be 'working towards' ISO27001

I'm in the process of an internal audit and I've got a vendor who is refusing to provide any information about their cybersecurity posture other than "We're working towards ISO27001 certification". They have claimed that any information provided about their security could compromise their potential certification. It hasn't been in depth questions, more along the lines of do they enforce 2FA, do you have an incident management process, do you use encryption at rest and in transit, etc.

With no …

audit certification claims compromise cybersecurity cybersecurity posture information internal internal audit iso27001 posture process security vendor working