7.7 Clear desk and clear screen
Rules requiring clear desks for papers and removable media and clear screens for processing facilities are to be defined and suitably enforced. Purpose: lower the risk of unauthorized access to, loss of or damage to information left on desks, screens and other reachable places, in and outside working hours. Guidance: publish a topic-specific policy on clear desks and clear screens to relevant parties and consider: locking away sensitive or critical information on paper or media, preferably in a safe or lockable cabinet, when not needed and especially when the office is empty; securing user endpoint devices with key locks or similar when unused or unattended; logging off unattended devices or protecting them with an authenticated screen and keyboard lock, and configuring timeouts or automatic logout on all computers and systems; having people collect printouts immediately and using printers that release jobs only after the originator authenticates at the device; storing sensitive documents and media securely and disposing of them securely when no longer needed; setting rules for screen pop-ups, such as turning off email and messaging notifications during presentations, screen sharing or in public; and wiping sensitive information from whiteboards and other displays after use. When facilities are vacated, a final sweep should confirm nothing is left behind, such as documents that have fallen behind drawers or furniture.
Source: ISO/IEC 27002:2022, 7.7. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Configuration evidence of screen lock and automatic logout timeouts on endpoints and systems · Physical access / facilities
- Secure print or follow-me printing configuration requiring authentication at the device · Physical access / facilities
periodic reviewEvidence produced at each review
- Clear desk walk-round or spot-check records with findings and follow-up · Physical access / facilities
- Records of final sweeps when offices or facilities are vacated · Physical access / facilities
governing documentDocuments that govern the control
- The topic-specific clear desk and clear screen policy and its communication · Policy repository / GRC workspace
- Availability of lockable storage and secure disposal bins · Policy repository / GRC workspace
First move
Common gaps auditors find
- Screen lock timeouts are long or can be disabled by users
- Sensitive printouts accumulate uncollected at shared printers
- Whiteboards in meeting rooms retain confidential content
- Notification pop-ups reveal confidential messages during screen sharing
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.6 Working in secure areas · 7.8 Equipment siting and protection