Clear desk and clear screen
Purpose
Cut the risk of unauthorised access to, or loss or damage of, information left visible on desks and screens.
How to meet this control
In short: Apply clear-desk and clear-screen rules.
- Step 01Publish a clear-desk and clear-screen policy and reinforce it through awareness communications and periodic walkthroughs
- Step 02Enforce automatic screen lock after a short idle timeout through MDM or group policy, and require lock-on-leave
- Step 03Provide lockable storage, such as pedestals or cabinets, for sensitive papers and removable media, and require they be secured when desks are unattended
- Step 04Deploy secure or follow-me printing that releases jobs only on badge authentication to stop documents sitting on trays
- Step 05Run periodic clear-desk spot checks and clear whiteboards and presentation screens of sensitive content after use
- Step 06Do a final sweep when vacating meeting rooms or offices so nothing sensitive is left behind
Tip: Auto-lock screens after a short idle timeout; lock away sensitive papers.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Set and communicate a clear desk and clear screen policy
- ›Lock away sensitive paper and electronic media when not needed, especially when the office is empty
- ›Secure user devices with key locks or other means when unattended
- ›Log off devices or use authentication-controlled locks, with automatic timeout enabled
- ›Have people collect printouts immediately, ideally using printers that require authentication
- ›Securely store and dispose of sensitive documents and media
- ›Manage on-screen pop-ups during presentations and clear sensitive content from whiteboards
- ›Do a final sweep when vacating facilities so no assets are left behind
Audit evidence to keep
- - The clear-desk and clear-screen policy
- - MDM or group-policy configuration showing enforced screen-lock timeout
- - Records of clear-desk spot checks or walkthrough findings
- - Secure-print configuration requiring badge release
- - Awareness material communicating the clear-desk rules
Common mistakes
- - Writing a policy but not operating the process
- - Keeping evidence in personal folders where auditors cannot trace it
- - Letting exceptions stay open with no owner or expiry date
Owner, cadence, and proof
Assign one accountable owner for A.7.7. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.