SP2 - good for you. Probably.
NTBugtraq which follows NT/2000/XP etc. security issues recommends that SP2 be supported because it's the first time ever MS has truly supported making a system secure *even* if that means pi$$ing off people who wrote insecure code in their applications.
Previously, it was "don't break the apps, even if they're not secure". This approach is better if it means fewer opportunities for worm/virus creators.
We will be starting a trial at our firm by installing a clean WinXP install with SP2 and installing our application software using test machines. If these work OK we will image this using Symantec Ghost and deploy it to our various models of PC. It is extremely unlikely we will be patching existing systems, but that's coz we can afford not to.
Incidentally we operate the Windows firewall on our internal network, but have customised it slightly. This is in addition to our dedicated firewall, in case a laptop brings something nasty inside the firewall. If you want to use Remote Control programs you have to open the firewall for that port though. In SP2 you just point at the program you need to get out and it figures out the rest.