Clear desk and clear screen

What the requirement asks

Rules requiring clear desks for papers and removable media and clear screens for processing facilities are to be defined and suitably enforced. Purpose: lower the risk of unauthorized access to, loss of or damage to information left on desks, screens and other reachable places, in and outside working hours. Guidance: publish a topic-specific clear desk and clear screen policy to relevant parties and consider: locking away sensitive or critical information on paper or media, preferably in a safe or lockable cabinet, when not needed and especially when the office is empty; securing user endpoint devices with key locks or similar when unused or unattended; logging off unattended devices or protecting them with an authenticated screen and keyboard lock, and configuring timeouts or automatic logout on all computers and systems; having people collect printouts immediately and using printers that release jobs only after the originator authenticates at the device; storing sensitive documents and media securely and disposing of them securely when no longer needed; setting rules for screen pop-ups, such as turning off email and messaging notifications during presentations, screen sharing or in public; and wiping sensitive information from whiteboards and other displays after use. When facilities are vacated, a final sweep should confirm nothing is left behind, such as documents that have fallen behind drawers or furniture. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Clear desk and clear screen are daily habits. The guidance asks for the rule, the check, the exceptions and the follow-up.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the topic-specific clear desk and clear screen policy and its communication and one live sample together.

Evidence an assessor asks for

• Clear deskThe topic-specific clear desk and clear screen policy and its communication
• Clear deskConfiguration evidence of screen lock and automatic logout timeouts on endpoints and systems
• Clear deskSecure print or follow-me printing configuration requiring authentication at the device
• Clear deskClear desk walk-round or spot-check records with findings and follow-up
• Clear deskAvailability of lockable storage and secure disposal bins
• Clear deskRecords of final sweeps when offices or facilities are vacated

The question an assessor will ask

An assessor will ask for the topic-specific clear desk and clear screen policy and its communication, then trace it to the system it protects. For A.7.7 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Screen lock timeouts are long or can be disabled by users
• Sensitive printouts accumulate uncollected at shared printers
• Whiteboards in meeting rooms retain confidential content
• Notification pop-ups reveal confidential messages during screen sharing

Before the next audit

Before the next audit, check one live sample for this gap: screen lock timeouts are long or can be disabled by users.