I can't imagine, "Just power it off" as a security mechanism, and can only imagine that compliance is somewhat less than 100%.
Also - I can imagine there are different levels of classification, and that the Secretary of State may be in places where the rules might be somewhat more strict.