Clear Desk and Clear Screen Policy Template (ISO/IEC 27001 A.7.7)

Clear Desk and Clear Screen Policy: [Organization name]

Topic-specific policy that sets the rules for keeping paper, removable media and screens free of unattended information at desks, in shared spaces, at home and while travelling, and for checking that the rules are followed. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A control A.7.7 (clear desk and clear screen), with implementation guidance in ISO/IEC 27002:2022. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Principles
3. Clear desk rules
4. Clear screen rules and enforced settings
5. Printing, copying and scanning
6. Meeting rooms, whiteboards and shared spaces
7. Hot desking and flexible offices
8. Home working, travel and public places
9. Roles and responsibilities
10. Checks, findings and metrics
11. Non-compliance and exceptions
12. Size tiers
13. Records and evidence
14. References

1. Purpose and scope

This policy makes sure that nobody can read, take or photograph organization information simply because it was left in view: on a desk, a screen, a printer tray, a whiteboard or a removable device, at any time of day. It applies to:

• every site in the site register of DOC-ISMS-055;
• home offices and any other place where personnel work remotely;
• all devices used for organization work, including managed laptops, phones, tablets and approved personal devices (DOC-ISMS-058);
• paper, notebooks, removable media, access badges, keys and hardware security tokens.

2. Principles

1. Leave nothing readable behind. When you step away, what you leave on your desk or screen must be safe for anyone passing to see.
2. Lock it, take it or shred it. Information you are not using is locked away, carried with you or securely destroyed.
3. Classification decides. Rules apply to anything classified Internal or higher under the data classification policy (data/data-classification-policy).
4. Technology first, habits second. Screens lock automatically and printers hold jobs until you are there. Habits cover what technology cannot.

3. Clear desk rules

4. Clear screen rules and enforced settings

4.1 Enforced settings

The endpoint and BYOD policy (DOC-ISMS-058) and the secure configuration baseline (DOC-ISMS-060) hold the full device settings. This table is the subset that clear screen depends on.

4.2 Human rules

5. Printing, copying and scanning

• Use secure pull printing (release by badge or PIN at the device) for all printing in shared spaces. Direct printing is allowed only for printers inside Z3 rooms.
• Collect printouts, copies and scans immediately. Uncollected print jobs are deleted automatically after [24 hours].
• Do not print Restricted information unless there is a business need approved by the information owner.
• Scan-to-email sends only to the user's own organizational address.
• Multifunction devices with internal storage are configured to overwrite job data and are sanitised before return to the leasing company or disposal (DOC-ISMS-057).
• Staff clear the device output tray when they find abandoned output, placing it in confidential waste and telling the owner if known.

6. Meeting rooms, whiteboards and shared spaces

• Wipe whiteboards and remove flip-chart pages after meetings that showed Internal or higher information. Photograph them to the team space first if the content is needed.
• Remove papers, notebooks, badges and cables from the room. Facilities or reception check rooms booked by visitors after use.
• Log out of meeting room devices and video conferencing accounts.
• Do not discuss Confidential matters in kitchens, lifts or open areas where visitors can overhear.
• Visitor-facing areas (Z1) hold no information above Public.

7. Hot desking and flexible offices

• Hot desks are cleared completely at the end of each use, not only at the end of the day. Nothing is left overnight.
• Personal lockers are assigned through [facilities booking system], with individual codes or badge access. Lockers are emptied when the holder leaves the organization.
• Docking stations and monitors at hot desks do not store information. Users disconnect and take laptops with them.
• Abandoned items found at hot desks at the end of the day are taken to [reception or security] and recorded in the lost property log. Information found is handled as a finding (section 10).
• Coworking spaces and serviced offices count as public places for this policy: the rules in section 8 apply in addition.

8. Home working, travel and public places

• At home, apply the clear screen rules and keep work papers out of sight of other household members and visitors. Lock devices when stepping away, even at home.
• Printing at home is [not allowed / allowed only for Internal information when a cross-cut shredder is available]. Confidential paper goes back to the office for confidential waste.
• In public places (trains, aircraft, cafes, coworking spaces), use a privacy screen filter for Confidential work, do not leave devices unattended and avoid calls that discuss Confidential matters.
• Never leave devices, papers or media visible in a vehicle. Lock them in the boot only for short stops and never overnight.
• Full rules for remote and travelling work are in DOC-ISMS-054 (isms/remote-working-policy).

9. Roles and responsibilities

10. Checks, findings and metrics

10.1 Check method

• Frequency: unannounced sweeps of each office floor [monthly] for the first year after issue, then [quarterly] when compliance stays at or above the target for three consecutive sweeps.
• Timing: after working hours or during lunch, varied so that the pattern is not predictable.
• Checkers: two people (a security champion and a facilities or ISMS team member). Checkers do not read documents beyond what is needed to judge classification.
• What is checked: CD-01 to CD-09 and CS-01, CS-06, uncollected print, whiteboards and meeting rooms.
• Remote check: the endpoint team reports [monthly] the percentage of devices with the enforced lock settings applied.

Restricted information found exposed is reported as a security event (DOC-ISMS-023) on the first occurrence, regardless of repeat history.

10.2 Metrics

10.3 Worked example of sweep results

In this example, compliance rose from 85.0% to 95.0% over the quarter. The ISMS manager kept monthly sweeps, because the rule requires three consecutive sweeps at or above target before moving to quarterly.

11. Non-compliance and exceptions

• First and second findings are handled by coaching and reminders. Repeated or deliberate non-compliance, or exposure of Restricted information through negligence, may be handled through the disciplinary process for security breaches (DOC-ISMS-052).
• Exceptions (for example a laboratory where screens must stay unlocked for monitoring) are requested through security/security-exception-request (DOC-ISMS-122) with compensating controls such as restricted room access and a dedicated display account.
• Recurring patterns are analysed as nonconformities with corrective action where they show a systemic cause (for example no lockers in a new area), using compliance/capa-nonconformity (DOC-ISMS-087).

12. Size tiers

13. Records and evidence

List these records in the control evidence matrix (isms/control-evidence-matrix) under A.7.7 and in the documented information register (DOC-ISMS-028).

14. References

Related templates: isms/physical-security-policy, isms/remote-working-policy, isms/endpoint-device-byod-policy, isms/secure-configuration-baseline, isms/information-labelling-handling-procedure, isms/employee-security-handbook, isms/security-disciplinary-process, data/data-classification-policy, security/security-awareness-program, security/security-exception-request, compliance/capa-nonconformity, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 (including Amd 1:2024) Annex A control A.7.7 and the guidance in ISO/IEC 27002:2022. The rules, settings, metrics and examples are original wording; no ISO/IEC text is reproduced. You need the official standards to apply the control: ISO/IEC 27001 at https://www.iso.org/standard/82875.html and ISO/IEC 27002 at https://www.iso.org/standard/75652.html. Check the current edition and amendments before use. Quillmere names are fictional. Template licence: MIT.