Government policies. Legacy code. Cascade of updating vendor contracts and waiting for them to update their product/service. The Webmaster frequently doesn't ha

Government policies. Legacy code. Cascade of updating vendor contracts and waiting for them to update their product/service. The Webmaster frequently doesn't have the autonomy to be able to prioritize the project they think is most critical. The switch from HTTP to HTTPS is almost never as simple as "call LetsEncrypt and switch the port number". If you have an existing HTTP site that includes Images, Script, Styles, Frames from other HTTP resources, switching the top of the page to HTTPS may break functionality on the page if the browser's security settings deny HTTP resources from being loaded on the newly HTTPS page. That said, there's really no reason any government shouldn't prioritize these fixes... except we are in the middle of a COVID-pocalypse where budgets are likely to get slashed. Sometimes it's "incompetence" of management (not seeing the risk after it's described to them or their underlings not communicating the risk), but mostly