Data classification will largely drive the requirements. An enterprise will adopt a data classification system to help identify which systems need which protections. We can assume your question applies to sensitive data. Even then, different requirements apply depending on the source of that data and the classification.
Sometimes, outside forces dictate the requirements. For example, due to the type of data we work with, we are audited every year by an outside party. They require, among other things, that we pass scans by Nessus and AppDetectivePro. So, to ensure we pass, we run those tools against systems in scope.
"Before you sign the check" is the time where an enterprise would make sure they have permission to do the required tests. For example, the contract might require the vendor to provide a test environment to run invasive application security scans. The procurement process might require that these scans be allowed before the product is purchased.
Vendors can be asked for proof that they've complied with standards. For example, vendors to the federal government must meet FedRAMP requirements. Cloud vendors are judged against SOC 2 requirements.