I have one safety concept for everything and not random ones for random devices.

Every machine is encrypted, unlocked per login.

Encryption is basically free so.