The Dutch government provides baseline standards: https://www.bio-overheid.nl/bio2/bio-producten/baseline-info...

I'm sure NixOS can provide those, but rather than each department figure out how to do that, organisations try to centralize figuring this out: which packages and configuration satisfies the requirements.

One of the items discusses MFA. Organisations will want to standardise on exactly which MFA devices they provide and support.