top of page

ISO 27001 Control: 7.7 Clear Desk & Clear Screen

Enhancing Security in the Workplace


Introduction

A clear desk and clear screen policy is an essential component of an organisation’s physical and information security strategy. By defining and enforcing clear rules for handling papers, removable storage media, and information displayed on screens, organisations can significantly reduce the risks of unauthorised access, loss, and damage to sensitive information.


Purpose of a Clear Desk and Clear Screen Policy

The primary objective of this policy is to protect sensitive information by minimising its exposure on desks, screens, and other accessible locations. This reduces the risk of unauthorised access during and outside normal working hours and ensures a secure and organised workplace environment.


Key Guidelines for Clear Desk and Clear Screen Practices

  1. Securing Sensitive Information

    • Lock away sensitive or critical business information, such as papers or electronic storage media, when not in use. Use safes, cabinets, or other secure furniture to store these items, particularly when leaving the office.

  2. Protecting User Endpoint Devices

    • Equip user endpoint devices with physical security measures, such as key locks, when unattended.

    • Ensure that devices are logged off or protected with screen and keyboard locks controlled by user authentication mechanisms when not in use.

    • Configure all computers and systems with automatic timeout or logout features to prevent unauthorised access.

  3. Collecting Outputs from Devices

    • Require users to collect printed documents from printers or multi-function devices immediately.

    • Encourage the use of printers with authentication functions, ensuring that only the originator can retrieve printouts while present at the printer.

  4. Secure Storage and Disposal

    • Store documents and removable storage media containing sensitive information securely when not in use.

    • When no longer required, dispose of such items using secure disposal mechanisms, such as shredding or data wiping.

  5. Managing Displayed Information

    • Establish rules for configuring screen pop-ups to minimise exposure of sensitive information during presentations, screen sharing, or in public areas. For instance, turn off new email and messaging notifications when possible.

    • Clear whiteboards and other display surfaces of sensitive or critical information as soon as it is no longer needed.

  6. Final Sweep Procedures

    • When vacating facilities, conduct a final sweep to ensure no sensitive assets are left behind. This includes checking for documents that may have fallen behind furniture or drawers.


Communication and Awareness

  • Develop and distribute a topic-specific policy on clear desk and clear screen practices to all relevant personnel.

  • Provide training and awareness sessions to reinforce the importance of these practices and ensure consistent adherence.


Additional Considerations

  • Regularly review and update the policy to adapt to changing organisational needs and emerging threats.

  • Monitor compliance through periodic audits and provide feedback to employees on areas of improvement.


Key Concepts and Domains

  • Control Type: Preventive

  • Security Properties: Confidentiality

  • Cybersecurity Concepts: Protection

  • Operational Capabilities: Physical Security, Asset Management


Conclusion

A clear desk and clear screen policy is a fundamental element of an organisation’s effort to safeguard sensitive information. By implementing robust guidelines and fostering a culture of security, organisations can significantly reduce risks associated with unauthorised access and data breaches. These measures not only enhance physical and information security but also promote a more organised and professional workplace environment.

Comments


About the author

Alan Parker is an IT consultant and project manager who specialises in IT governance, process implementation, and project delivery. With over 30 years of experience in the industry, Alan believes that simplifying complex challenges and avoiding pitfalls are key to successful IT management. He has led various IT teams and projects across multiple organisations, continually honing his expertise in ITIL and PRINCE2 methodologies. Alan holds a degree in Information Systems and has been recognised for his ability to deliver reliable and effective IT solutions. He lives in Berkshire, UK, with his family.

bottom of page