The challenge for British security leaders is no longer whether NCSC guidance on credential management is sound, but how to operationalize it effectively.