I would let them decide based on their security policy.

If Microsoft states that they don't have any for a project like this, I would be wary of taking it too seriously.