# Clear Desk and Clear Screen Policy: [Organization name]

> Topic-specific policy that sets the rules for keeping paper, removable
> media and screens free of unattended information at desks, in shared
> spaces, at home and while travelling, and for checking that the rules
> are followed. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A
> control A.7.7 (clear desk and clear screen), with implementation
> guidance in ISO/IEC 27002:2022. Replace every `[bracketed]` value and
> every row marked *Example*.

<!--
Guidance: How to use this template
- Use it for every organization in the ISMS scope, office-based,
  hybrid or fully remote. Clear screen rules apply wherever a screen
  is used.
- Fill section 4 (screen lock settings) first with the values your
  device management actually enforces, then write the human rules
  around them. A policy that says "lock after 5 minutes" while devices
  lock after 15 is a nonconformity waiting to be found.
- The main pitfall is having rules without checks. Auditors ask for
  the last clear desk sweep and what happened to the findings
  (section 10).
- Keep this policy short enough to fit in the employee security
  handbook (DOC-ISMS-073); the detail on checks is for the owner.
- Related templates: `isms/physical-security-policy`,
  `isms/remote-working-policy`, `isms/endpoint-device-byod-policy`,
  `isms/information-labelling-handling-procedure`,
  `isms/employee-security-handbook`, `security/security-awareness-program`,
  `isms/control-evidence-matrix`.
-->

## Document control

<!-- Guidance: Controlled document under clause 7.5. Changes to lock timers or check frequency are a new version. -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-056 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@ciso], [@head-of-facilities], [@it-endpoint-lead], [@hr-lead] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024, Annex A A.7.7; ISO/IEC 27002:2022 |
| Next scheduled review | YYYY-MM-DD (at least annually) |
| Applies to | All personnel, contractors and visitors using organization information |
| Parent policies | DOC-ISMS-001 Information security policy; DOC-ISMS-055 Physical security policy |
| Related documents | DOC-ISMS-054 Remote working policy; DOC-ISMS-058 Endpoint and BYOD policy; DOC-ISMS-042 Information labelling and handling procedure |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Policy owner | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Endpoint management | [@it-endpoint-lead] | [Confirmed technical settings] | YYYY-MM-DD |
| Top management | [@coo] | [Approved] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | First issue |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Hot desking rules added after move to a flexible office; check frequency changed to monthly |

## Contents

<!-- Guidance: Sections 2 to 8 are the rules people follow. Sections 9 to 12 are how the owner runs and proves the policy. -->

1. Purpose and scope
2. Principles
3. Clear desk rules
4. Clear screen rules and enforced settings
5. Printing, copying and scanning
6. Meeting rooms, whiteboards and shared spaces
7. Hot desking and flexible offices
8. Home working, travel and public places
9. Roles and responsibilities
10. Checks, findings and metrics
11. Non-compliance and exceptions
12. Size tiers
13. Records and evidence
14. References

## 1. Purpose and scope

<!-- Guidance: State what the policy protects and where it applies. Pitfall: a scope that stops at the office door while half the staff work from home. -->

This policy makes sure that nobody can read, take or photograph
organization information simply because it was left in view: on a
desk, a screen, a printer tray, a whiteboard or a removable device,
at any time of day. It applies to:

- every site in the site register of DOC-ISMS-055;
- home offices and any other place where personnel work remotely;
- all devices used for organization work, including managed laptops,
  phones, tablets and approved personal devices (DOC-ISMS-058);
- paper, notebooks, removable media, access badges, keys and hardware
  security tokens.

## 2. Principles

<!-- Guidance: Short and memorable. These lines often go on posters and in onboarding. -->

1. **Leave nothing readable behind.** When you step away, what you
   leave on your desk or screen must be safe for anyone passing to see.
2. **Lock it, take it or shred it.** Information you are not using is
   locked away, carried with you or securely destroyed.
3. **Classification decides.** Rules apply to anything classified
   Internal or higher under the data classification policy
   (`data/data-classification-policy`).
4. **Technology first, habits second.** Screens lock automatically and
   printers hold jobs until you are there. Habits cover what technology
   cannot.

## 3. Clear desk rules

<!-- Guidance: Concrete rules for paper, media and small items. Questions to answer: is lockable storage available to everyone? Where do confidential papers go? Pitfall: asking people to lock documents away without giving them a locker or pedestal. -->

| Rule ID | Rule |
|---|---|
| CD-01 | At the end of the working day, desks are cleared of all papers, notebooks and removable media classified Internal or higher. |
| CD-02 | When leaving the desk for more than [15 minutes], put Confidential and Restricted papers and media in locked storage or take them with you. |
| CD-03 | Every desk user has access to lockable storage (pedestal, locker or cabinet). Keys or locker codes are personal and not left in the lock. |
| CD-04 | Confidential paper that is no longer needed goes into locked confidential waste bins or a cross-cut shredder, never the general waste or recycling. |
| CD-05 | Passwords, recovery codes and PINs are never written on notes, desk pads or the underside of keyboards. Use the approved password manager. |
| CD-06 | Badges, keys and hardware security tokens are not left on desks. Carry them or lock them away. |
| CD-07 | Removable media in use is labelled according to DOC-ISMS-042 and locked away when not in use (see DOC-ISMS-055 section 10). |
| CD-08 | Laptops left in the office overnight are locked in storage or secured with a cable lock in Z2 or higher zones. |
| CD-09 | Post and deliveries containing information are collected promptly and not left in open trays in reception. |

## 4. Clear screen rules and enforced settings

<!-- Guidance: Write the technical settings that device management enforces, then the human rule. Ask the endpoint team to confirm each value and record their approval above. Auditor check: compare the stated timeout with a device policy export. -->

### 4.1 Enforced settings

| Setting | Managed laptops and desktops | Phones and tablets | Shared and kiosk devices | Enforced by |
|---|---|---|---|---|
| Automatic screen lock after inactivity | [5 minutes] *(Example)* | [2 minutes] *(Example)* | [5 minutes] *(Example)*, session ends after [15 minutes] | Device management (MDM) profile |
| Unlock method | Password, PIN or biometric with fallback | PIN of at least [6] digits or biometric | Personal sign-in, no shared accounts | Identity provider and MDM |
| Lock screen content | No message previews or calendar details | Notification previews hidden on lock screen | No content shown | MDM profile |
| Privacy screen filter | Required for staff who [handle Restricted information in public places] | Not applicable | Required in Z1 public-facing areas | Asset issue checklist |

The endpoint and BYOD policy (DOC-ISMS-058) and the secure
configuration baseline (DOC-ISMS-060) hold the full device settings.
This table is the subset that clear screen depends on.

### 4.2 Human rules

| Rule ID | Rule |
|---|---|
| CS-01 | Lock your screen every time you leave the device, even for a moment (for example Windows key + L on Windows, Control + Command + Q on macOS). |
| CS-02 | Close or minimise confidential documents and messages before sharing your screen in a call, and share a single window rather than the whole desktop. |
| CS-03 | Position screens so they cannot be read by visitors, through windows or by people behind you in public places. |
| CS-04 | Log out of shared devices and close browser sessions when finished. |
| CS-05 | Do not disable or work around automatic locking, for example with mouse-jiggler tools. |
| CS-06 | Turn off displays in meeting rooms and switch off conference room screens after presentations. |

## 5. Printing, copying and scanning

<!-- Guidance: Printers and copiers are a common source of findings. Questions to answer: do printers hold jobs until release? Do multifunction devices store images on internal storage? Pitfall: a printer tray full of uncollected HR letters. -->

- Use secure pull printing (release by badge or PIN at the device) for
  all printing in shared spaces. Direct printing is allowed only for
  printers inside Z3 rooms.
- Collect printouts, copies and scans immediately. Uncollected print
  jobs are deleted automatically after [24 hours].
- Do not print Restricted information unless there is a business need
  approved by the information owner.
- Scan-to-email sends only to the user's own organizational address.
- Multifunction devices with internal storage are configured to
  overwrite job data and are sanitised before return to the leasing
  company or disposal (DOC-ISMS-057).
- Staff clear the device output tray when they find abandoned output,
  placing it in confidential waste and telling the owner if known.

## 6. Meeting rooms, whiteboards and shared spaces

<!-- Guidance: Shared rooms are where information is most often left behind. Questions to answer: who checks rooms after meetings? Pitfall: a whiteboard with a network diagram photographed by the next visitor group. -->

- Wipe whiteboards and remove flip-chart pages after meetings that
  showed Internal or higher information. Photograph them to the team
  space first if the content is needed.
- Remove papers, notebooks, badges and cables from the room. Facilities
  or reception check rooms booked by visitors after use.
- Log out of meeting room devices and video conferencing accounts.
- Do not discuss Confidential matters in kitchens, lifts or open areas
  where visitors can overhear.
- Visitor-facing areas (Z1) hold no information above Public.

## 7. Hot desking and flexible offices

<!-- Guidance: In flexible offices there is no "my desk" to leave things on. Questions to answer: are there enough lockers? How is end-of-day clearance enforced? Pitfall: lockers shared by teams with a code everyone knows. -->

- Hot desks are cleared completely at the end of each use, not only at
  the end of the day. Nothing is left overnight.
- Personal lockers are assigned through [facilities booking system],
  with individual codes or badge access. Lockers are emptied when the
  holder leaves the organization.
- Docking stations and monitors at hot desks do not store
  information. Users disconnect and take laptops with them.
- Abandoned items found at hot desks at the end of the day are taken
  to [reception or security] and recorded in the lost property log.
  Information found is handled as a finding (section 10).
- Coworking spaces and serviced offices count as public places for this
  policy: the rules in section 8 apply in addition.

## 8. Home working, travel and public places

<!-- Guidance: Link to the remote working policy rather than repeating it. Questions to answer: what is the rule for printing at home? What about trains and cafes? Pitfall: allowing printing at home with no way to destroy the paper securely. -->

- At home, apply the clear screen rules and keep work papers out of
  sight of other household members and visitors. Lock devices when
  stepping away, even at home.
- Printing at home is [not allowed / allowed only for Internal
  information when a cross-cut shredder is available]. Confidential
  paper goes back to the office for confidential waste.
- In public places (trains, aircraft, cafes, coworking spaces), use a
  privacy screen filter for Confidential work, do not leave devices
  unattended and avoid calls that discuss Confidential matters.
- Never leave devices, papers or media visible in a vehicle. Lock them
  in the boot only for short stops and never overnight.
- Full rules for remote and travelling work are in DOC-ISMS-054
  (`isms/remote-working-policy`).

## 9. Roles and responsibilities

<!-- Guidance: Keep it short. The key point is that line managers own behaviour in their teams and the ISMS manager owns the check process. -->

| Role | Responsibilities |
|---|---|
| Policy owner (ISMS manager) | Maintains the policy, schedules checks, reports metrics, tracks repeat findings |
| IT endpoint management | Enforces and evidences the settings in section 4.1 |
| Facilities and reception | Provide lockable storage, confidential waste bins and shredders; check visitor-booked meeting rooms |
| Line managers | Brief their teams, act on findings, include repeat issues in performance conversations |
| Security champions or check team | Carry out clear desk sweeps and record findings |
| All personnel | Follow sections 3 to 8, challenge colleagues politely and report found information |

## 10. Checks, findings and metrics

<!-- Guidance: This section is what turns a poster into a working control. Questions to answer: how often are sweeps done, by whom, with what form, and what happens to the results? Pitfall: sweeps that name and shame; aim for coaching and trends. Auditor check: last three months of sweep results and evidence that repeat findings were followed up. -->

### 10.1 Check method

- **Frequency:** unannounced sweeps of each office floor [monthly] for
  the first year after issue, then [quarterly] when compliance stays at
  or above the target for three consecutive sweeps.
- **Timing:** after working hours or during lunch, varied so that the
  pattern is not predictable.
- **Checkers:** two people (a security champion and a facilities or
  ISMS team member). Checkers do not read documents beyond what is
  needed to judge classification.
- **What is checked:** CD-01 to CD-09 and CS-01, CS-06, uncollected
  print, whiteboards and meeting rooms.
- **Remote check:** the endpoint team reports [monthly] the percentage
  of devices with the enforced lock settings applied.

```mermaid
flowchart TD
  A["Sweep scheduled"] --> B["Walk the floor with checklist"]
  B --> C{"Finding?"}
  C -- "No" --> D["Record desk as compliant"]
  C -- "Yes" --> E["Secure the item and leave a reminder card"]
  E --> F["Record finding with desk and rule ID"]
  F --> R{"Restricted information exposed?"}
  R -- "Yes" --> K["Report as security event via DOC-ISMS-023"]
  R -- "No" --> G{"Repeat finding for same person in 3 months?"}
  G -- "No" --> H["Coaching note to the person"]
  G -- "Yes" --> I["Line manager follow-up"]
  I --> J{"Third finding in 3 months?"}
  J -- "Yes" --> K
  J -- "No" --> L["Close with manager note"]
  D --> M["Monthly metrics"]
  H --> M
  L --> M
  K --> M
```

Restricted information found exposed is reported as a security event
(DOC-ISMS-023) on the first occurrence, regardless of repeat history.

### 10.2 Metrics

| Metric | Definition | Target | Reported to |
|---|---|---|---|
| Clear desk compliance rate | Compliant desks divided by desks checked | At or above [95%] | Steering committee (DOC-ISMS-007) monthly |
| Repeat finding rate | Persons with 2 or more findings in 3 months divided by persons with any finding | Below [10%] | Steering committee quarterly |
| Uncollected print jobs | Jobs deleted after the holding period per month | Falling trend | ISMS manager |
| Enforced lock coverage | Managed devices with lock settings applied divided by managed devices | At or above [98%] | Measurement programme (DOC-ISMS-080) |
| Restricted exposures | Findings involving Restricted information | 0 | Management review |

### 10.3 Worked example of sweep results

| Sweep ID | Date | Site | Desks checked | Compliant | Findings | Compliance rate |
|---|---|---|---|---|---|---|
| CDS-001 *(Example)* | 2027-01-14 | Head office, floor 3 | 120 | 102 | 18 | 85.0% |
| CDS-002 *(Example)* | 2027-02-11 | Head office, floor 3 | 118 | 106 | 12 | 89.8% |
| CDS-003 *(Example)* | 2027-03-16 | Head office, floor 3 | 121 | 115 | 6 | 95.0% |
| **Quarter total *(Example)*** | | | **359** | **323** | **36** | **90.0%** |

| Finding by rule *(Example, same quarter)* | Count |
|---|---|
| CD-01 papers left overnight | 14 |
| CD-05 password written down | 3 |
| CD-06 badge or token left on desk | 5 |
| CD-08 laptop not locked away | 7 |
| CS-01 screen unlocked | 4 |
| Uncollected confidential print | 3 |
| **Total** | **36** |

In this example, compliance rose from 85.0% to 95.0% over the quarter.
The ISMS manager kept monthly sweeps, because the rule requires three
consecutive sweeps at or above target before moving to quarterly.

## 11. Non-compliance and exceptions

<!-- Guidance: Proportionate consequences, and a route for genuine exceptions such as a room that cannot have lockers. Pitfall: jumping to disciplinary action for a first minor finding, which kills the reporting culture. -->

- First and second findings are handled by coaching and reminders.
  Repeated or deliberate non-compliance, or exposure of Restricted
  information through negligence, may be handled through the
  disciplinary process for security breaches (DOC-ISMS-052).
- Exceptions (for example a laboratory where screens must stay
  unlocked for monitoring) are requested through
  `security/security-exception-request` (DOC-ISMS-122) with
  compensating controls such as restricted room access and a
  dedicated display account.
- Recurring patterns are analysed as nonconformities with corrective
  action where they show a systemic cause (for example no lockers in a
  new area), using `compliance/capa-nonconformity` (DOC-ISMS-087).

## 12. Size tiers

<!-- Guidance: Show how the same rules scale. These are the library's working tiers, not official definitions. -->

| Topic | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Context | 46 staff, one office plus remote staff, mostly digital work | 320 staff, two offices, clinical customer data on screens in support teams | 2,400 staff, 6 sites in 4 countries, shop floors and OT control rooms |
| Main risks | Screens on video calls, home working, few papers | Printed schedules with patient data from hospital customers, open-plan support floors | Shared terminals on plant floors, engineering drawings, visitors in plants |
| Enforcement | MDM lock settings, one shredder, lockers for hot desks | Pull printing, confidential waste service, pedestals at every desk | Group MDM baseline, kiosk mode for shared terminals, site-specific confidential waste contracts |
| Checks | Monthly sweep in the first year, then quarterly, by the ISMS manager (0.5 FTE) and office manager; monthly MDM report | Monthly sweeps per office by security champions and the 3-person security team | Site sweeps by local champions, results consolidated by the security office into one group metric |
| Reporting | ISMS manager to the monthly management meeting, summary in management review | Steering committee monthly | Site management monthly, group steering committee quarterly |

## 13. Records and evidence

<!-- Guidance: Records that prove the control operates. Map each to the control evidence matrix (DOC-ISMS-033). -->

| Record | Owner | Location | Retention | Proves |
|---|---|---|---|---|
| Sweep checklists and results | ISMS manager | [GRC tool or shared drive] | [3 years] | A.7.7 operation |
| Coaching and manager follow-up notes | Line managers | [HR system, restricted] | According to HR retention | Follow-up of findings |
| MDM lock settings export and coverage report | IT endpoint lead | [MDM console export] | [3 years] | Section 4.1 enforced |
| Confidential waste collection certificates | Facilities | [Facilities records] | [3 years] | CD-04 operation |
| Policy acknowledgements | HR | [HR system] | Employment plus [1 year] | Communication (7.3, 7.4) |
| Exceptions | ISMS manager | DOC-ISMS-122 register | Exception life plus [1 year] | Approved deviations |

List these records in the control evidence matrix
(`isms/control-evidence-matrix`) under A.7.7 and in the documented
information register (DOC-ISMS-028).

## 14. References

<!-- Guidance: Cite editions exactly. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022 + Amd 1:2024 | 2022, Amd 1 published 2024-02-23 | Annex A A.7.7. https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html |
| ISO/IEC 27002:2022 | 2022 | Guidance for A.7.7. https://www.iso.org/standard/75652.html |

Related templates: `isms/physical-security-policy`,
`isms/remote-working-policy`, `isms/endpoint-device-byod-policy`,
`isms/secure-configuration-baseline`,
`isms/information-labelling-handling-procedure`,
`isms/employee-security-handbook`, `isms/security-disciplinary-process`,
`data/data-classification-policy`, `security/security-awareness-program`,
`security/security-exception-request`, `compliance/capa-nonconformity`,
`isms/control-evidence-matrix`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 (including Amd 1:2024) Annex
A control A.7.7 and the guidance in ISO/IEC 27002:2022. The rules,
settings, metrics and examples are original wording; no ISO/IEC text is
reproduced. You need the official standards to apply the control:
ISO/IEC 27001 at https://www.iso.org/standard/82875.html and ISO/IEC
27002 at https://www.iso.org/standard/75652.html. Check the current
edition and amendments before use. Quillmere names are fictional.
Template licence: MIT.