ISO 27001 A.7.7 - Clear Desk and Clear Screen

Requirement

“Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities shall be defined and appropriately enforced.”

Plain-language meaning

People should not leave sensitive papers, removable media, printed documents, fax messages, or unlocked screens exposed where unauthorized people can see, photograph, remove, alter, or discard them.

The control should apply during working hours and outside working hours, with stricter rules where information classification or visitor exposure requires it.

Why this matters

Open offices, shared work areas, visitors, cleaners, contractors, and mobile phone cameras make unattended information easy to capture. Disorderly desks also increase the chance of misfiling, accidental disposal, and damage during fire, flood, or other events.

Implementation guidance

1. Define clear desk rules

Rules should cover:

• papers and notebooks;
• removable media;
• printed reports;
• working files;
• confidential waste;
• filing cabinets and safes;
• shared desks and hot desks;
• end-of-day checks;
• visitor and cleaner access periods.

2. Define clear screen rules

Rules should cover:

• screen locking when leaving a workstation;
• password-protected screensavers;
• automatic lock timeout;
• shutting down or locking equipment outside working hours;
• privacy screens where needed;
• behavior when visitors enter sensitive work areas.

3. Manage printers and fax machines

Printers and fax machines can expose sensitive information.

Controls may include:

• pull printing;
• secure printer locations;
• regular checks of output trays;
• no unattended sensitive print jobs;
• secure fax location where fax is still used;
• user training on optional secure-print functions.

4. Match enforcement to information classification

More sensitive areas need stronger monitoring and enforcement. A general office may need basic clean-desk checks; a regulated processing area may need documented inspections and sanctions for repeated non-compliance.

5. Make compliance practical

Staff often see this control as irritating. Training should explain real risks: phone photos, cleaners, visitors, misplaced records, waste disposal, and disaster damage. Enforcement should be simple, fair, and consistent.

Audit guidance

Auditors should verify:

• clear desk and clear screen policy/rules exist;
• rules align with information classification;
• staff understand and follow the rules;
• screens lock when unattended;
• sensitive papers and media are not left exposed;
• filing cabinets, safes, and storage are used correctly;
• printers and fax machines are suitably located and controlled;
• pull printing is available or used where needed;
• sanctions or corrective actions are fair and consistently applied.

Audit observation should cover both working hours and non-working hours where practical.

Evidence examples

Strong evidence

• Clear desk and clear screen rules are documented and communicated.
• Auto-lock settings are configured and enforced.
• Sensitive print/fax workflows are controlled.
• Walkthroughs show desks, screens, cabinets, and printers are managed.
• Repeat non-compliance leads to training or corrective action.

Weak evidence

• Policy exists but no one checks compliance.
• Screens rely only on user memory with no auto-lock.
• Printers contain piles of uncollected documents.
• Staff do not know how to use secure printing.
• Cleaning staff or visitors can view unattended sensitive information.
• Enforcement is inconsistent or informal.

Common failures

Exam traps

Related controls and concepts

• A.7 Physical Controls MOC
• A.7.3 Securing Offices Rooms and Facilities
• A.7.6 Working in Secure Areas
• A.5.12 Classification of Information
• A.5.13 Labelling of Information
• A.5.14 Information Transfer
• A.5.10 Acceptable Use of Information and Other Associated Assets
• Clear Desk and Clear Screen Checklist
• Printer and Fax Security Checklist
• A.7.7 Audit Evidence Pack
• A.7.7 Audit Checklist

KB-ready summary

• Define clear desk and clear screen rules.
• Use technical enforcement for screen locking.
• Control printers, faxes, removable media, and confidential waste.
• Match controls to information classification and visitor exposure.
• Audit by direct observation, not policy review only.

Templates and checklists

• Clear Desk and Clear Screen Checklist
• Printer and Fax Security Checklist
• A.7.7 Audit Checklist