ISO 27001 Control 7.7: Clear Desk and Clear Screen

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

In short: ISO 27001 control 7.7, clear desk and clear screen, requires rules for keeping papers and removable media out of sight and screens locked when unattended. For a small business that means automatic screen locking, sensible handling of printed material, and the same rules applying to senior desks as to everyone else.

Clear desk is one of those controls where organisations know they have a policy, and quietly accept that it is not very practical. One client of mine found it very difficult to enforce theirs when the CEO’s office looked like a bombsite. Everyone could see it, and everyone drew the obvious conclusion about how seriously the rule was meant.

The problem has shrunk. Most of us print far less than we used to, and in my experience younger staff print least of all. But it has not disappeared. Papers still get printed, screens still get left unlocked, and whiteboards still carry last week’s client strategy.

This page covers what control 7.7 asks for, how to make it practical, and how to get leadership to lead it.

What control 7.7 actually asks for

The control requires clear desk rules for papers and removable storage media, and clear screen rules for information processing facilities, to be defined and appropriately enforced. In practice:

• Clear desk. Confidential papers and media put away when unattended, especially at the end of the day.
• Clear screen. Screens locked when unattended, with automatic locking as the backstop.
• Printers and whiteboards. Nothing left in output trays; boards wiped after meetings.
• Enforced. Checked and followed up, not just written down.

In the 2013 edition this was control A.11.2.9.

When the CEO’s desk is a bombsite

Clear desk lives or dies on leadership. If the most senior person in the office ignores it, nobody else will take it seriously, and managers will feel awkward raising it with anyone. It is a small control, but it is one of the most visible signals of whether the ISMS is real.

If that is your situation, have the conversation privately, with the reason rather than the rule: what is actually on that desk, and who walks past it? Then make it easy. A lockable drawer, a confidential waste bin within reach, and a two-minute habit at the end of the day are usually enough.

Make it practical

• Print less. The best clear desk is one with nothing printed on it. Make digital the default.
• Give people somewhere to put things. A lockable drawer or locker each, and a confidential waste bin.
• Automate the screen part. Enforce a screen lock after a few minutes of inactivity through device management. Then the rule only has to cover stepping away.
• Use pull printing if you print much, so documents only come out when the person is at the printer.
• Wipe whiteboards as the last thing in every meeting.

Remote and hybrid working

Clear desk and screen apply at home and in co-working spaces too, arguably more so in shared spaces. Locked screens in cafés and on trains, no client papers left on the kitchen table, and care with what is visible on video calls. Cover it in your remote working guidance under control 6.7.

Checking it

A ten-minute walk round at the end of the day, once a quarter, is enough for most offices. Note what you find, follow up privately, and record it. It is good evidence for this control and for compliance checking under 5.36.

What auditors will look for

Clear desk is audited by walking round, so these are the things I look at.

1. A walk round. Desks, printers, whiteboards, screens.
2. Screen lock settings. Enforced centrally, or left to individuals?
3. Evidence of checks. When was the last walk round and what did it find?
4. Senior desks. Yes, I look.
5. Remote guidance. What do people do at home?

Common issues

• A clear desk policy that leadership visibly ignores.
• No lockable storage, so the policy cannot be followed.
• Screen locks left to individual choice, or set to 30 minutes.
• Printouts sitting in printer trays.
• Whiteboards left with client details on them.
• No checks, so nobody knows whether it works.

The self-check

Walk past the most senior desk in the building first.

• What is on the most senior desk in your office right now?
• Does every device lock its screen automatically within a few minutes?
• Does everyone have somewhere lockable to put papers?
• What was left on the printer last night?
• When did anyone last check?

The first question is the one to sit with.

When the CEO is the problem

I have worked with a business where the most senior person’s office was, to put it kindly, chaotic, and the person responsible for security found it very hard to change. The problem was not really the paper. It was that he was leading everyone else, and the moment staff see the person at the top ignore a policy, they ask the obvious question: if he doesn’t follow it, why should I? It is a battle many security leads will recognise.

Clear desk also matters overnight. When laptops were stolen from desks in a swipe-card office at the education charity where I worked (see control 7.1), every laptop left out on a desk overnight was taken. A clear desk policy that includes locking equipment away at night would have made that a much smaller loss.

Screens are the other half of the control, and the weaker one. Most people take routine video calls at their desks and move to a meeting room for sensitive ones, which is sensible. Very few organisations, though, have built a culture of locking screens when people walk away. In my experience only around one office in five enforces an automatic screen lock, and perhaps fewer (see my findings). The usual reason is trust: we are all colleagues here. But this is about defence in depth, not distrust. A screen lock after a few minutes, enforced centrally, costs nothing and removes the question.

How control 7.7 links to other clauses and controls

• Control 5.36, Compliance with policies, rules and standards. Checking the rule is followed.
• Control 6.7, Remote working. Clear desk and screen away from the office.
• Control 8.1, User endpoint devices. Automatic screen locking.
• Control 5.12, Classification of information. Which papers count as confidential.
• Control 7.14, Secure disposal or re-use of equipment. Confidential waste.

Frequently asked questions

Sources and further reading

Official guidance and standards referred to on this page.

• Interactive logon: Machine inactivity limit. Microsoft documentation on enforcing automatic screen lock.
• ISO/IEC 27002:2022. The implementation guidance that accompanies the controls.
• A guide to data security. ICO guidance, including physical security of paper records.
• Device security guidance. NCSC guidance, including screen lock settings.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call