Having worked in defense, I generally had stricter rules around phones than around website access. That is really a bit surprising to me.

I guess contractors are all over the map in how they try to make sure to comply with the "rules", though.