It is hilarious when other government agencies don't listen to NIST about this.  My $BUREAU certainly does not and inflicts nasty requirements on employees.  Citizens doing business with the $BUREAU get a bit shy about digital interaction.