ISO 27001 Clear Desk and Clear Screen Explained – Annex A 7.7

ISO 27001 7.7 Clear Desk and Clear Screen equires staff to lock physical files and digital screens whenever work areas are left unattended. This key safety rule keeps confidential business data safe from theft and unauthorised viewing in all work spaces.

Key Takeaways

• Clear paper files from desks: Lock away sensitive paper documents, printouts, and notebooks inside secure storage units when leaving workstations unattended.
• Lock screens when stepping away: Auto-lock or manually lock computer screens every time you step away from your work area to prevent screen viewing.
• Protect portable storage media: Store external hard drives, memory sticks, and removable media in locked drawers when not in active use.
• Clear shared printers quickly: Collect printed documents from shared printers immediately so sensitive papers do not sit in public view.
• Shred sensitive paper waste: Dispose of unwanted confidential documents using locked shredding bins or cross-cut paper shredders.
• Apply controls across all locations: Enforce clear desk and screen safety rules across main offices, home work spaces, and travel locations.
• Set automatic screen timeouts: Configure all company screens to lock automatically after a short period of inactivity.
• Fit screen privacy filters: Use physical screen privacy filters on displays located in open plan offices or public visitor areas.

How to Implement ISO 27001 Annex A 7.7

• Draft a clear desk policy: Write clear guidelines that require staff to lock paper files away and lock screens when leaving desks.
• Set short screen timeouts: Enforce automatic screen lock settings across all devices after brief periods of inactivity.
• Supply secure storage units: Provide staff with lockable desk drawers, filing cabinets, or personal lockers to store paper files safely.
• Set up print release controls: Position printers in secure areas and require user codes or badges before papers print out.
• Provide secure shredding bins: Place locked confidential waste bins around work areas so staff can discard sensitive paper notes safely.
• Fit screen privacy filters: Equip displays in high-traffic or public areas with privacy covers to block side viewing.
• Train workers on clear desk habits: Educate staff to clear paper files and portable storage items from desks at the end of every work day.
• Run regular spot checks: Inspect work areas after hours to check for unlocked screens, left-out papers, or loose storage items.
• Extend rules to home work spaces: Require staff to apply the same clear desk and screen safety habits in home offices and travel sites.
• Clear whiteboards and meeting rooms: Wipe down meeting room boards and collect paper notes right after every discussion finishes.
• Log clear desk audit results: Record findings from routine desk checks to track progress and prove compliance to auditors.

How to Audit ISO 27001 Annex A 7.7

• Review the clear desk policy: Inspect written guidelines to check that clear rules exist for securing paper documents, screens, and media.
• Run out-of-hours desk checks: Walk through office zones after working hours to look for left-out papers, unlocked screens, or loose media.
• Verify screen auto-lock settings: Sample active workstations to check that automated screen timeouts lock displays after short inactive periods.
• Inspect physical storage units: Check that desk drawers, filing cabinets, and storage lockers are present and locked properly.
• Check shared printer areas: Inspect shared printing stations to confirm sensitive printouts do not sit unattended in tray bins.
• Audit secure paper waste disposal: Inspect work zones to confirm locked shredding bins are available and used for confidential paper waste.
• Check screen privacy covers: Verify displays in high-traffic corridors, glass rooms, or public areas carry physical privacy screen covers.
• Inspect meeting room whiteboards: Check shared meeting areas to confirm whiteboards are wiped clean and paper notes are removed after use.
• Review desk check audit logs: Sample internal check records from routine site reviews to confirm physical checks happen regularly.
• Check remote worker compliance: Review training logs and sign-offs to confirm home workers apply clear desk rules in remote work areas.
• Verify physical media locking: Check that removable storage items, access cards, and keys sit inside locked drawers when not in use.
• Audit staff training records: Review staff completion logs for annual security training on clear desk and clear screen safety.
• Check clear desk incident logs: Review logged physical security slips to confirm staff report and fix left-out papers or unlocked screens fast.
• Inspect visitor work areas: Verify guest desks and hot-desk spaces remain free of sensitive company notes and printed files.

Audit Evidence Checklist

• Clear desk policy document: Supply an approved, version-controlled policy outlining clear rules for securing paper files, screens, and media.
• Screen lock policy settings record: Provide central system configuration records showing automated screen lock timeouts set to brief inactive periods.
• Out-of-hours desk check logs: Produce dated physical inspection logs from routine sweep checks showing compliance levels across work areas.
• Staff training completion records: Present staff training logs proving all workers finished annual security awareness training on clear desk rules.
• Physical storage hardware inventory: Supply records showing the allocation of lockable desk drawers, filing cabinets, or lockers to staff.
• Secure waste disposal contracts: Provide service agreements and collection certificates for locked shredding bins and safe paper destruction.
• Print release system logs: Supply system reports proving print jobs require user codes or badges at printer stations before paper outputs.
• Remote worker sign-off forms: Show signed staff agreements confirming home and mobile workers follow clear desk and screen safety rules.
• Clear desk security incident logs: Produce log records showing how your team tracks, fixes, and reports left-out papers or unlocked screen slips.
• Privacy screen filter distribution list: Maintain a log showing physical privacy filters fitted on displays in open plan or high-traffic zones.
• Physical media issuance records: Maintain logs tracking the assignment and safe return of removable storage devices, keycards, and physical keys.
• Visitor log and escort checks: Provide guest sign-in logs and staff escort records to prove visitors carry supervision near active workstations.

What to Teach Employees

• Lock screens when stepping away: Teach workers to lock their device screens every time they leave their desk, even for brief moments.
• Clear paper from desks daily: Instruct staff to lock paper documents and notebooks inside drawers or cabinets at the end of every work day.
• Lock up removable media: Remind workers to store external storage drives, memory keys, and access cards in locked storage when not in active use.
• Collect printouts right away: Teach staff to pick up printed paper from shared printers right away so documents do not sit in public view.
• Use locked shredding bins: Instruct workers to throw away confidential paper waste using locked shredding bins or paper destruction units.
• Clear whiteboards after meetings: Train teams to wipe clean room boards and collect paper notes right after every meeting finishes.
• Position screens away from view: Teach workers to angle screens away from windows, doors, and walkways to block screen viewing.
• Use physical privacy covers: Encourage staff in open office zones or high-traffic areas to fit physical screen privacy filters.
• Apply rules when working remotely: Remind home workers to protect paper files and lock screens to block household or guest viewing.
• Keep keys and badges secure: Instruct workers never to leave physical keys or smart access cards sitting on unattended desks.
• Keep guest areas clear: Train staff to keep temporary hot desks and visitor tables free of sensitive paper files and storage items.
• Report left-out items quickly: Teach workers to report unsecured paper, left-in media, or unlocked screens to security leads right away.
• Hide written passwords and notes: Warn staff never to write down passwords or security codes on sticky notes placed near screens or desks.
• Secure physical pop-up displays: Instruct workers to close or cover physical flip charts and wall boards that hold sensitive project details.

Common Implementation Challenges

• Leaving screens unlocked when stepping away: Staff often walk away from desks without locking displays. Set short auto-lock screen timeouts and train staff to lock screens manually every time.
• Accumulating paper clutter on desks: Workers leave paper notes, printouts, and books on desks overnight. Provide accessible lockable storage units and run routine out-of-hours desk checks.
• Leaving printouts unattended at shared printers: Printed paper sits in output trays where unapproved staff can view it. Use print release controls that require user codes before paper prints out.
• Lack of secure physical storage: Offices often lack enough lockable drawers, cabinets, or lockers for paper files. Supply lockable storage hardware for every worker handling sensitive information.
• Exposing screens to high-traffic areas: Workstation displays face windows, glass walls, or walkways, enabling screen viewing. Position screens away from public view or fit physical screen privacy covers.
• Leaving written passwords on paper notes: Staff write access codes or passwords on paper notes attached to screens or desks. Enforce clear rules against writing down passwords anywhere near work desks.
• Forgetting to clear meeting room whiteboards: Teams leave sensitive notes on room boards after discussions finish. Train staff to wipe clean dry-erase boards and remove paper charts right after meetings.
• Inconsistent habits in remote work areas: Home workers often forget to secure paper files and screens from guests. Extend clear desk policies to remote work agreements and run regular training.
• Leaving removable media unlocked: Staff leave external storage drives, smart cards, or keys on open desks. Require all portable storage items to sit inside locked drawers when not in active use.
• Improper paper waste disposal: Workers throw paper files into open waste bins instead of shredders. Place locked shredding bins in convenient office spots for safe paper disposal.
• Managing flexible hot-desking zones: Shared visitor desks accumulate left-behind paper files and loose media. Require hot-desk users to clear all personal items and papers at the end of each day.
• Cultural resistance to regular checks: Staff may view desk checks as intrusive or strict. Position desk audits as supportive safety checks and share clear compliance results with teams.
• Unsecured key storage for locked drawers: Staff leave physical keys to locked file cabinets sitting in open desk trays. Enforce secure key storage controls so drawer keys remain safe at all times.
• Overlooking pop-up visual display boards: Teams leave project wall charts and noticeboards visible in shared corridors. Shield or cover physical display boards holding sensitive business data from visitor view.

How to Measure Effectiveness (KPIs)

• Clear desk check pass rate: Measure the percentage of workstations found fully clear of exposed paper and media during out-of-hours spot checks.
• Unlocked screen incident rate: Track the total number of unattended, unlocked displays discovered during routine office sweep checks.
• Unattended print job count: Measure the average number of sensitive paper printouts left sitting in shared printer tray bins each week.
• Screen auto-lock deployment rate: Track the proportion of company devices configured with short automated screen lock timeouts.
• Lockable storage availability rate: Measure the percentage of staff handling sensitive data who have access to lockable desk drawers or cabinets.
• Screen privacy cover coverage: Track the proportion of displays in high-traffic or public areas fitted with physical screen privacy filters.
• Clear desk training completion rate: Measure the percentage of staff who complete annual training on clear desk and screen rules.
• Meeting room whiteboard compliance: Track the proportion of meeting rooms found with whiteboards wiped clean after discussions finish.
• Clear desk incident report count: Monitor the number of security slips reported by staff involving unsecured files or loose storage items.
• Remote worker compliance sign-off rate: Track the percentage of home workers who sign agreements to follow clear desk rules in remote work areas.
• Written password violation count: Measure the number of instances where staff leave access codes or passwords written on paper notes near desks.
• Confidential paper waste shredding volume: Monitor the weight or frequency of paper destruction collections to ensure proper use of locked bins.

Requirements by Environment

• Physical Office: Lockable pedestals, secured whiteboards, and locked shredding consoles are mandatory.
• Home Office: Screens must face away from windows. Sensitive papers require lockable storage or immediate destruction.
• Public Spaces: Use of privacy filters is essential. Personnel must manually lock screens before leaving the device.

Related ISO 27001 Controls

ISO 27001 Control 7.7 works in concert with other physical and logical safeguards.

• This control relies on Annex A 5.12 Classification of Information to define which papers require locking.
• It also integrates with Annex A 7.5 Protecting Against Physical and Environmental Threats by protecting hardware from environmental damage.
• Finally, it works with Annex A 8.1 User Endpoint Device Security to secure the actual endpoint devices used by personnel.