I'm assuming you haven't worked for
"Normal" practice is:
- Inside: Complete chaos, no one follows the rules and everyone but contractors can just about get away with murder.
- Outside: "We follow all rules. A contractor reconfigured something and the issue has been resolved. We've put additional controls in place to ensure this doesn't happen again." (While the "contractor" could have been an admin logging into a server to do Windows Updates instead of the idiot that configured the firewall incorrectly to get their stupid app working. Pure example here.)
Signed: A guy that was both a Full Time Employee as well as a contractor for several entities.