Here is a fun read, reminiscent of the WSJ saga of 2007: "Numbers: 7 Security Rules Employees Love to Break."
Includes are the old faves "Copying confidential information onto a USB memory stick", "Accessing web-based e-mail accounts from a workplace computer", etc.
But there is a truly bizarre one: "Sending workplace documents as an attachment in e-mail." WTH? Is sending them in the body of the email message better? Do they really mean "... to personal email"?
In any case, read it.