Information Security Management
Clear Desk and Clear Screen Policy: What ISO 27001 Asks For, With a Full Example
A clear desk and clear screen policy is the shortest policy in an ISMS and the easiest to audit, because the auditor can check it by walking through the office. It says that confidential material is not left out when nobody is at the desk, and that screens are locked when nobody is at the keyboard. ISO 27001 asks for it under Annex A control 7.7, and it is one of the few controls where the auditor’s evidence is what they can see rather than what you can show them.
The complete toolkit, every policy, template and record you need. Free, no commitment
This guide covers what the control requires, a complete policy you can adopt as it stands, how auditors test it, and where it fits with the rest of your physical security controls.
Free physical security policy template (Word)
The template below is the physical security policy from our toolkit. Section 4.1 is the clear desk and clear screen policy; the rest covers visitors, physical access control, secure areas, equipment siting, environmental protection, assets off-premises, secure disposal and incident reporting. Replace the placeholders and remove the sections that do not apply to you.
It is one of 18 policy templates in the free ISO 27001 toolkit.
What control 7.7 requires
Control 7.7, clear desk and clear screen, says that clear desk rules for papers and removable storage media, and clear screen rules for information processing facilities, shall be defined and appropriately enforced. Two halves:
- Clear desk covers the physical: papers, notebooks, printouts, USB sticks, hardware tokens, anything that can be picked up or read by someone who should not.
- Clear screen covers the digital: locking the computer when you step away, not leaving sensitive information displayed where it can be seen, and clearing shared screens and whiteboards after use.
The word “enforced” matters. The control is not met by a paragraph in a policy. It is met when the behaviour is normal in the office, and an auditor who walks past an unlocked laptop showing a customer list at 12.45 on a Tuesday will record that, whatever the policy says.
Why it still matters when everyone works from home
The control is older than hybrid working, but the risk has moved rather than gone. In a shared office or co-working space the people at the next desk are not your colleagues. On a train or in a cafe the screen is visible to whoever is behind you. At home, a laptop left unlocked is open to family, visitors and anyone who comes to the door. Our acceptable use policy guide covers the remote working rules; the clear desk and screen rules should apply everywhere, and the policy should say so.
It also protects against the mundane. The commonest clear desk failures I see are not espionage: a printout of a payroll run left on the printer, a password on a sticky note, a visitor’s view of a whiteboard still covered in last week’s client names.
A complete clear desk and clear screen policy
Here is a one-page policy that would satisfy control 7.7 for most small businesses. Adopt it as it is, or use it as the clear desk section of a wider physical security policy, which is how our toolkit handles it.
Clear Desk and Clear Screen Policy
Purpose. To make sure that confidential information is not exposed to people who are not authorised to see it, whether on a desk, a screen, a printer or a whiteboard, in the office or anywhere else we work.
Scope. All staff, contractors and temporary workers, at every location where company information is handled, including home and public places.
Clear desk rules. 1. Confidential papers, notebooks and removable media are locked away when you leave your desk for the day, and are not left unattended during the day in areas visitors or non-staff can reach. 2. Printed material is collected from printers immediately; uncollected printouts are shredded, not left in the tray. 3. Passwords, PINs and access codes are never written down and left at the desk. 4. Removable media and hardware tokens are kept locked away when not in use. 5. Whiteboards and flip charts are wiped after meetings in rooms used by visitors or shared with other tenants. 6. Confidential paper is disposed of in the confidential waste bins or shredded, never in general waste.
Clear screen rules. 7. Lock your screen every time you leave your computer, however briefly (Windows key + L, or Control + Command + Q on a Mac). 8. Computers lock automatically after 5 minutes of inactivity; do not change this setting. 9. Position screens so they cannot be read from public areas, windows or visitor seating, and use a privacy screen when working in public places. 10. Close or minimise confidential documents before sharing your screen or presenting. 11. Do not leave a device logged in and unattended in a public place, a vehicle or a shared space, even if it is locked.
Responsibilities. Everyone follows these rules. Line managers check them during the normal working day. The Information Security Manager includes a clear desk walk-round in the internal audit programme.
Non-compliance. Breaches are recorded as security incidents. Repeated or serious breaches are handled under the disciplinary process.
Review. Annually, at management review.
That is the whole thing. It does not need a page of definitions or a section on the history of the control.
How auditors test it
Control 7.7 is one of the few where the test is observational. A certification auditor will:
- Walk the floor, usually during the lunch break or at the end of the day, and look at desks, printers, whiteboards and screens.
- Check that the automatic screen lock is set and ask what the timeout is.
- Ask two or three staff what the rules are and whether anyone checks.
- Look for evidence of enforcement: a clear desk walk-round on the internal audit programme, or an incident record where a breach was picked up.
An office that is tidy on audit day and a policy nobody can describe in interview is a weak position. A policy that staff can recite, a screen lock they cannot change, and a record of the last walk-round is a strong one.
Making it stick
- Enforce the screen lock technically. Group policy, Intune, Jamf or the equivalent sets the timeout; staff cannot turn it off. That converts the hardest rule to enforce into one that enforces itself.
- Give people somewhere to put things. A clear desk policy with no lockable storage is a policy that will be broken every evening.
- Follow-me printing, or at least a shredder next to the printer.
- Walk-rounds. Once a quarter, five minutes, a line in the internal audit log. The point is less to catch people than to be able to show the auditor that somebody checks.
- Include it in induction alongside the acceptable use policy, and record that it was covered.
Mistakes I see most at audit
- Screen lock timeout set to 30 minutes or more, or left to the user to set. Most auditors expect something in the range of 5 to 15 minutes.
- The policy exists only inside another document and staff do not know it applies to them.
- Home working not mentioned. The policy talks about “the office” and nobody has worked there since 2020.
- Printers. Uncollected output is the single most common physical finding I raise.
- No evidence of checking. The policy says managers will monitor compliance; nobody can show that they ever have.
Where it fits
Control 7.7 is one of the fourteen physical controls in Annex A, alongside physical entry (7.2), securing offices (7.3), equipment siting (7.8), storage media (7.10) and secure disposal (7.14). Most small businesses put all of these in one physical security policy with the clear desk rules as a section, which is what the template above does. The clear screen half overlaps with the acceptable use policy and the user endpoint devices control (8.1); a single sentence in each pointing to the other avoids the two drifting apart.
Where to go next
The clear screen rules are usually repeated in the acceptable use policy, which every member of staff signs. For the full set of Annex A controls see the controls list, for the other policy guides see the ISO 27001 policies hub, and for help getting an ISMS to certification our ISO 27001 consultancy service covers the physical controls with you.
Frequently asked questions
What is a clear desk and clear screen policy?
A short policy requiring that confidential papers and removable media are not left out when nobody is at the desk, and that computer screens are locked when nobody is at the keyboard. ISO 27001 requires it under Annex A control 7.7, and it applies wherever company information is handled, including at home and in public places.
What should a clear desk policy include?
Rules for papers and media (lock away at end of day, collect printouts immediately, no written passwords, secure disposal), rules for screens (lock when leaving, automatic timeout, position screens away from public view, clear before screen sharing), who is responsible, what happens on breach, and how often it is reviewed. One page is enough.
How long should the screen lock timeout be?
Most auditors expect 5 to 15 minutes of inactivity, set centrally so users cannot change it. Longer timeouts are a common audit finding. Staff should still lock manually whenever they step away.
How do ISO 27001 auditors check the clear desk policy?
By looking. They walk the office, often at lunchtime or the end of the day, check desks, printers, whiteboards and screens, ask staff what the rules are, and look for evidence that someone checks compliance, such as a walk-round on the internal audit programme.
Does the clear desk policy apply to home workers?
Yes. Control 7.7 applies to all locations where information is handled. A clear desk policy that only mentions the office is a common gap; the rules should cover home, co-working spaces and public places, with privacy screens for the last.
ISO 27001 Online Course + Full Toolkit
Stop guessing. Follow a proven step-by-step process.
“Highly recommended for anyone looking to understand ISO 27001, whether attempting it on your own or even using a consultant.“
Verified customer review
£285
Instant access
✓ Full toolkit included ✓ Learn as you build ✓ 12-month access ✓ 6 hours of video ✓ Call + email support
Author Background
This article was written by Alan Parker, an ISO 27001 consultant and founder of Iseo Blue Limited. He helps UK SMEs achieve certification in 90 days or less, often without a dedicated security team or a large budget.
With over 30 years in IT governance and information security, Alan works with software companies, IT service providers, managed service providers, and professional services firms across the UK, Europe, and internationally.
Qualifications: Certified ISO/IEC 27001:2022 Lead Auditor,
ITIL v3 Expert, ITIL v4 Bridge, PRINCE2 Practitioner. Named IT Project Expert of the Year (2024, UK). Alan writes in plain English for busy teams who need to get things done.
Connect on LinkedIn or Bluesky, or explore his free ISO 27001 tools and templates at iseoblue.com. B.Sc (Hons) Information Systems, CISMP certified.
