In the defense of IT everywhere, I once was a "sole" IT department at a reasonable size non-profit. I tried hard to force security but if the top of the org cha

In the defense of IT everywhere, I once was a "sole" IT department at a reasonable size non-profit. I tried hard to force security but if the top of the org chart refuses, there isn't much you can do but just keep trying. A lot of the office even knew the CEO's password which he used for everything. Google Apps had a nice feature at the time that lets you see the strength of your users' passwords. If you sorted it from weakest to strongest, you literally had our org chart. Talking to other people who work with security, this doesn't seem to be all that uncommon.