I worked on a minor, non-secure, tangentially GHCQ-aligned project. They're the most risk averse organisation I've ever met. Like, pathologically risk averse. I'd bet a small mortgage they had no oversight of that call.