[imglorp]

I do wonder.

The Windows 11 STIG says use the Windows 10 STIG.

    https://public.cyber.mil/?s=windows+11

The Windows 10 STIG says basically fix this stuff before using.

    CAT I (High): 26 CAT II (Med): 241 CAT III (Low): 18

    https://stigviewer.com/stig/windows_10/

So it seems they have a high tolerance for shenanigans. But what will they do about the online part?

[sneak]

Microsoft will give them whatever they request. When you spend that much money you can just ask for a custom build. I would imagine that NSA TAO and other such parts of the USG are provided access to much of the Windows source already.

Microsoft and US intelligence and the US armed forces are practically vertically integrated at this point, they are the Lockheed of software.

"off the shelf" hasn't meant that for years.