NCSC are supposed to be doing this, but they're genuinely clueless and just like doing PR.

I also don't think it's reasonable to say it's lack of awareness, the same people wouldn't give the launch codes to a 3rd party, it doesn't require any technical clue to apply this.