15 character minimum passwords that expire every 90 days and require MFA to remote in from home with 3 separate login sessions just to get to your PC, along with stripped down rights for everyone, even IS. The rights are so strict that if you wanted to, for instance, update a trusted application like Notepad++ because a recent exploit was found which would be a security concern, you can't use the auto-update feature of the application; you have to download it manually from their repository, and run it using a special admin account created for you that doesn't have an associated email address but also has a 90 day password requirement. But you wouldn't been able to use their repository 6 months ago because we block any IP address outside the US and their previous service was located in UK, so if you wanted to keep that piece of software up-to-date with security and vulnerability patches (which they've harped on a number of times before) you'd have to find alternative download services located in the US regardless of how shady.

I wish I was joking.