7.7 Clear desk and clear screen
Requires defined and enforced rules for clearing papers and removable storage media from desks, and for clearing the screens of facilities used to process information.
5
artefacts
1
held by a system
2
at each review
hard
to go live
Physical access / facilities
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Technical enforcement evidence for screens, such as enforced screen lock timeout configuration across the estate · Physical access / facilities
periodic reviewEvidence produced at each review
- Evidence of physical checks or sweeps, with findings and follow up · Physical access / facilities
- Evidence covering shared spaces, home working and printing, including collection at the printer · Physical access / facilities
governing documentDocuments that govern the control
- The clear desk and clear screen rules, defining what must be cleared and to what standard · Policy repository / GRC workspace
- Provision of secure storage sufficient for people to comply, such as lockable storage at each workstation · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Physical access / facilities on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Rules issued with no secure storage provided, making compliance impossible
- Screen lock configured on corporate laptops while shared terminals, kiosks and operational consoles are excluded
- Printed output left uncollected at shared printers, which is the most commonly observed failure
- No checks performed, so compliance is asserted from the existence of the policy
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet7.6 Working in secure areas · 7.8 Equipment siting and protection