Heres how classified computing works. "secret" is a classification used only by the US federal government.

1. You pick from a list of common IT vendors that meet NIST standards. all 3-4 major vendors meet these standards, so pick any one...even mac.

2. Your IT department images the OS and applies STIGS to the OS to harden it. things like PW policy and disk crypto. stigs are verified and reviewed, with exceptions as necessary for the given type of classified information work. STIG reviews and DOD CCRI reviews are EXHAUSTING. they take months. your team works like dogs to ensure every i gets dotted. civilians can and should consider STIG's for their laptops.

https://web.nvd.nist.gov/view/ncp/repository

3. laptops, if theyre used for SECRET/NOFORN are NEVER removed from the SCIF/secure enclave. theyre kept in a secure facility and checked out when needed for work. they are audited frequently. a missing laptop under your checkout can earn you a seven year prison sentence. you take it extremely seriously.

4. TOP SECRET and SECRET/NOFORN are commonly air-gapped. hardware, if its special and not on a DOD list, its reviewed by the DOD for months, "sealed" and returned to be used for a defined amount of time subject to review.

5. once that laptop is done being "secret" it returns with no ram, no disk and sometimes other kit removed as demanded. the disk is shredded in an industrial shredder, the RAM too. you bill the DoD for a percentage of the hardware that has to be destroyed, and since your the government everything is expensed and has a PTN/charge code.