Clear desk and clear screen

Plain-language summary

Setting and enforcing rules that stop papers, removable media and unlocked screens from exposing information when nobody is watching — desks cleared, documents locked away, printouts collected and screens locked whenever people step away.

What the clause is really asking

Much information leaks without any hacking: a printout left on the copier, a payroll sheet on a desk overnight, an unlocked laptop in the canteen. This control asks you to set rules for what may be left out on desks — paper and removable media — and for leaving screens unlocked, and then to check that people follow them. A topic-specific policy is the usual anchor, covering locking sensitive papers and media away when not in use, especially after hours; locking screens when leaving, with an automatic lock as backstop; collecting printouts at once or using secure print; wiping whiteboards and flip charts; and clearing meeting rooms. The misunderstanding is that this is a tidiness rule; it follows information classification, so strictness can rise with sensitivity. In plants, look at the quality and production offices where customer complaints, drawings and personnel data sit beside shop-floor traffic, and at shared shop-floor terminals where a locked screen would stop production, so access has to be controlled another way.

What auditors look for

Auditors do an unannounced walk-round, usually early morning or after hours, looking at desks, printers, whiteboards, meeting rooms and unlocked screens, and noting what they find. They ask for the policy and the automatic screen-lock setting in the device management or group policy configuration. They ask whether secure print is used and look in printer output trays. They ask for your own clear desk inspection records and what was done about repeat failures. The hard question: what did your last clear desk check find, and what changed afterwards?

Typical evidence

Clear desk and clear screen policy; central automatic screen-lock configuration; secure print or follow-me printing settings; lockable storage provided where sensitive paper is handled; clear desk inspection checklists and scores; follow-up of repeat failures; awareness material; access arrangements for shared shop-floor terminals.

How to comply — recommendations

Write a one-page policy that ties strictness to your classification scheme. Enforce screen lock centrally after a few minutes of inactivity and teach the lock-screen shortcut. Turn on secure print for multifunction printers. Provide lockable drawers or cabinets wherever sensitive paper is handled. Run a monthly walk-round with a simple checklist, leave a friendly card on desks that fail, and report the score by department. On the shop floor, review shared terminals and give them role-based, least-privilege access and short session timeouts where a screen lock would stop the line.

Common nonconformities

No clear desk or clear screen policy; confidential documents left on desks or printers overnight; screens left unlocked with no automatic lock configured; whiteboards with sensitive data left visible; no lockable storage provided; inspections never performed or results not acted on; shared shop-floor terminals left logged in with a privileged account.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.