I agree that it is not a mandate yet. NSA does have some interesting insight and expertise they acquire in this area. Time and time again, we see experts make

I agree that it is not a mandate yet. NSA does have some interesting insight and expertise they acquire in this area. Time and time again, we see experts make recommendations, then legislation and rules make it mandatory. A burning example is most of NIST special publications. NIST makes no rules, mandates and such. Yet, mandates (e.g.,DFARS, DEAR) point to the recommendation as the requirement. Right now there are two of these playing out in the cybersecurity field - zero trust and passwordless authentication. So those who down this comment, you are right, it is not a mandate. Those who up this comment, you are right, it is likely to become a mandate.