OPSEC at the office that I retired from, was almost NIL, to say the best about it.
Several people were upset in that office and others, after I sent and email to the security office, advising that certain CD's were used in every day work laptops.
The security office sent out an advisory to not access the CD's until further notice. If information was needed, everyone had to call in on a STU III and ask for it.
Other than myself, I knew only one person that had any experience handling classified material.