So where I would be more concerned is with _clients_ and their security requirements. Often we would run into really onerous requirements at my last consulting firm, so we would often get a laptop from the client themselves they could control and manage access to code, etc.

Otherwise you probably open yourself to all kinds of liabilities I wouldn't want to deal with.