Or a busybody (speaking from personal experience). About 18 months after me raising this issue and referencing both NCSC and NIST, the rules at the org I'm con

Or a busybody (speaking from personal experience). About 18 months after me raising this issue and referencing both NCSC and NIST, the rules at the org I'm contracting with were changed. I have no idea whether my suggestion made any difference.