ISO 27001 Control A.7.7: Clear Desk and Clear Screen

Most information leaks are not dramatic. A printout left on a meeting room table, a laptop open on a café counter, a whiteboard full of customer names that nobody wiped after the workshop. A.7.7 deals with exactly these small, everyday exposures. It is the seventh of 14 physical controls in our walk through Annex A, and one of the easiest to explain and one of the hardest to keep alive.

Honestly? This is the control where policy and reality drift apart fastest. Everybody agrees a clear desk is a good idea, and then a busy Tuesday arrives. The goal is not a monastic workspace. It is a set of rules that are sensible enough for people to follow, backed by a little enforcement so they keep following them.

What the control requires

Annex A control 7.7 of ISO 27001:2022 states that clear desk rules for papers and removable storage media and clear screen rules for information processing facilities shall be defined and appropriately enforced.

The key elements:

Clear desk rules - what happens to paper and removable storage media when nobody is using them
Clear screen rules - what happens to displays, workstations and other information processing facilities when a person steps away
Defined - the rules are written down, and they say who they apply to and in which places
Appropriately enforced - someone checks, and there are consequences or at least conversations when the rules are ignored

A.7.7 is a preventive control, according to the attributes in ISO/IEC 27002:2022. It reduces the chance that information is seen, copied or taken by someone who should not have it. Annex A states the control in a single sentence; ISO 27002 gives the guidance, including the point that the rules should take into account the classification of information, the legal and contractual requirements, and the risks of the surrounding environment. Notice the word “appropriately”. A shared open-plan floor and a locked private office do not need identical rules.

How to implement clear desk and clear screen

Write rules people can remember

Start with a short topic-specific rule set, ideally one page. Cover the situations that actually occur in your organization:

Paper and removable media containing sensitive information are locked away when the desk is unattended, and always at the end of the day
Screens are locked when the user leaves the device, and set to lock automatically after a short idle period
Printouts are collected from printers straight away, or released with a badge or PIN so they only print when the owner is standing there
Whiteboards, flip charts and sticky notes are cleared at the end of meetings, and photographs of them are treated like any other business record
Meeting rooms are checked for leftover documents and devices before people leave

Link the rules to your classification scheme. Public brochures may stay on a desk; a draft contract with a customer should not. If you do not yet have a scheme, the rule can simply say “anything you would not want a visitor to read”. Where you do have one, tie each level to a handling rule. Our later posts on classification and labelling cover the scheme itself; for now, the point is that the clear desk rule is the physical expression of those handling rules.

Make compliance easy

Rules fail when they are inconvenient. If people have nowhere to lock their papers, they will not. Provide lockable drawers or cabinets near the people who need them, shredders or secure waste bins in reasonable reach, and a simple way to stash a laptop. For shared or hot-desking spaces, lockers matter more than any policy paragraph.

On the screen side, rely on technology rather than memory. Configure automatic lock after a few minutes of inactivity on laptops, desktops and shared terminals, and require authentication to resume. Teach the keyboard shortcut for locking a screen; it takes two seconds and it becomes a habit within a week. Be careful with kiosks, reception machines and any shared display that needs to stay visible: decide deliberately what they show and limit it to what is safe to show.

Think about where people actually work

The same rule set has to cope with different settings. In the office, think about glass walls and windows that let a passer-by read a monitor, and about screens facing circulation routes. At home, think about family members and shared rooms, which links to our post on remote working. In public places, privacy filters and common sense apply: a train carriage is not the right place to review a confidential board paper.

Visitors and contractors deserve a thought as well. Cleaners, maintenance staff and delivery people move through offices when many employees are gone, so the end-of-day clear-up is part of the protection. The same mindset underlies the rules for working in secure areas, where the stakes are higher and the rules stricter.

Enforce kindly, and measure

Enforcement does not have to mean punishment. Many organizations run a simple walk-round after hours, record how many desks had sensitive material left out, and share the trend with teams. Fix the cause when you see it: a team that always leaves papers out may simply lack a cabinet. Repeat or deliberate breaches belong in the disciplinary process, but that should be the last step, not the first. Include the rules in onboarding and refresh them through information security awareness, education and training, and give the results to management as part of your monitoring under clause 9.1.

A.7.3 connection. Securing offices, rooms and facilities shapes where sensitive work happens, which reduces how much needs clearing away.

A.7.4 connection. Physical security monitoring can reveal documents or devices left in sensitive spaces after hours.

A.7.6 connection. Working in secure areas sets stricter conduct rules for the most sensitive rooms; clear desk and clear screen extend the same thinking to the rest of the workplace.

A.6.3 connection. Information security awareness, education and training is how people learn and remember the rules.

A.6.7 connection. Remote working carries clear desk and clear screen expectations into homes and public places.

Clause 9.1 connection. Monitoring, measurement, analysis and evaluation is where after-hours walk-round results become evidence that the rules work.

Forward reference. Equipment siting and protection (A.7.8) is the next control in the series, and it looks at where equipment is placed so that screens and devices are not exposed in the first place.

What auditors check

A written rule. Auditors look for a clear desk and clear screen rule, whether in a standalone topic-specific policy or inside a wider policy, and check that it matches the way your organization works.

Observation on site. Expect a walk through the office. Papers left on desks, unlocked screens, full printer trays and unwiped whiteboards are the things that get noticed, and they are noticed quickly.

Technical settings. Auditors may ask to see the screen-lock configuration on a few devices and whether users can change it.

Facilities for compliance. They look for lockable storage, secure bins or shredders, and secure printing, since a rule without the means to follow it is a weak control.

Awareness. Interviews reveal whether people know the rules and why they exist. A staff member who can explain the reason is worth more than a signed acknowledgement.

Checks and follow-up. Records of walk-rounds, findings and corrective action show that enforcement is real, and tie into internal audit and corrective action.

Common mistakes to avoid

A rule without lockable storage. If there is no drawer, locker or cabinet, the rule asks for something people cannot do.

Relying on memory for screen locking. Automatic timeouts catch what habit misses. Do not leave this to goodwill.

Forgetting the printer. Sensitive documents that print to a shared device and sit in the tray all afternoon are a classic finding. Use secure print release where you can.

Ignoring whiteboards and meeting rooms. Strategy sessions and incident reviews leave the richest material behind. Add an end-of-meeting check to the room routine.

One rule for every setting. A policy that treats a locked private office like an open-plan floor creates resentment and workarounds. Scale the rule to the risk.

Enforcing only once. A single push before the audit fades in a month. Light, regular checks are better than a large annual campaign.

Treating it as only a paper problem. Removable media such as USB drives and external disks fall under the control too, and they hold far more than a printout does.

How 27kay can help

We help organizations turn a clear desk and clear screen rule into something people actually follow, with realistic storage, sensible technical settings and light checks that do not feel like surveillance. As part of ISO 27001 implementation, we review how your offices and remote setups really work, write rules that fit them, and prepare the evidence an auditor will ask for. For the full picture, see our ISO 27001 knowledge hub.

If an auditor walked through your office at 7pm tonight, what would they find on the desks? Get in touch - we will help you find out first, and fix it without fuss.