Table of contents
- ISO 27001 Clear Desk Policy
- ISO 27001 Clear Desk Policy Template
- ISO 27001 Clear Desk Policy Example
- How to write a clear desk policy
- What should ISO 27001 Clear Desk Policy Contain?
- How to implement a clear desk policy in 3 simple steps
- Clear Desk Policy for employees and customers
- Clear Desk Policy for the organisation
- Clear Desk Policy for remote workers
- ISO 27001 Clear Desk Policy FAQ
- Further Reading
ISO 27001 Clear Desk Policy
The ISO 27001 Clear Desk Policy sets out the guidelines and framework for how you protect physical information and high value tangible, real world assets.
A clear desk policy is one of the simplest ways to be compliant with basic information security. It is a simple way to protect your business, your customers, your employees and even yourself.
A clear desk policy is designed to make sure that confidential information is physically protected when not in use.
ISO 27001 Clear Desk Policy Template
The ISO 27001 Clear Desk Policy Template is pre written and ready to go. As part of the Ultimate ISO 27001 Toolkit but uniquely available to download standalone. The benefit of the template is that it will save you time and is proven best practice.
DO IT YOURSELF ISO 27001
All the templates, tools, support and knowledge you need to do it yourself.
ISO 27001 Clear Desk Policy Example
The following is the ISO 27001 clear desk policy example.
How to write a clear desk policy
It can be straight forward to write an ISO 27001 Clear Desk Policy . These are the steps that you would take.
Time needed: 4 hours and 30 minutes
How to write the clear desk policy in a step by step guide.
- Create your version control and document mark-up
ISO 27001 documents require version control of the author, the change, the date and the version as well as document mark up such as document classification.
- Write the document purpose
Write the purpose of the document. The purpose of this policy is to reduces the risks of unauthorised access, loss of and damage to information during and outside normal working hours.
- Write the scope of the policy
The scope of this policy is:
All company employees and external party users.
Confidential information in electronic and paper form.
Monetary items and associated resources. - Write the principle on which the policy is based
Clear desk and clear screen are ensuring that resources of value and confidential information are secured from unauthorised access, loss, or damage when not in use.
- Write the policy content
Set out the framework and what you do for clear desk under the following headings:
Internal, Confidential and Critical Information
Printers, Photocopiers and Reproduction Technology
Cash, Cheques, Bank Cards, Payment Devices
Media Disposal
Desk Cleaning - Communicate the clear desk policy to appropriate staff
Consider as part of your required communication plan the different ways and timings that are appropriate to you to communicate the clear desk policy. Make sure it is stored somewhere that people can easily access it at any time and that they can, indeed, access it.
- Get evidence that the staff have accepted the clear desk policy
Using your acceptance methodology get staff to accept that they have read and understand the policy and accept its terms. Maintain evidence of this for future audit and potential disciplinary process.
- Manage Exceptions
There may be things that cannot be secured for business or technical reasons. These should be identified, recorded, agreed and managed via risk management with effective compensating controls in place.
What should ISO 27001 Clear Desk Policy Contain?
The ISO 27001 Clear Desk Policy is required to be presented in a certain way. What we mean by that is that the policy is expected to have certain document markup. Document mark up is just a fancy words for having certain information on the policy. It will need version control, a version number, an owner, an information security classification. An example ISO 27001 Clear Desk Policy table of contents would look something like this:
- Document Version Control
- Document Contents Page
- Clear Desk and Clear Screen Policy
- Purpose
- Scope
- Principle
- Internal, Confidential and Critical Information
- Printers, Photocopiers and Reproduction Technology
- Cash, Cheques, Bank Cards, Payment Devices
- Media Disposal
- Desk Cleaning
- Pop-ups and Notifications
- Policy Compliance
- Compliance Measurement
- Exceptions
- Non-Compliance
- Continual Improvement
- Areas of the ISO 27001 Standard Addressed
How to implement a clear desk policy in 3 simple steps
Whether you are going for ISO 27001 certification or just wanting to implement good, best practice these 3 simple steps will show you how to implement the policy followed in the next section with how to write it.
Implementing a clear desk policy is straight forward, and on the whole, is common sense.
- Inform staff of where the policy is, encourage them to read it and test their understanding of what is required.
- Provide cross cut shredders and lockable storage in office’s, next to printers and to home workers that need to print confidential information
- Perform checks on a periodic basis by doing an office floor walk or remote video call check
Clear Desk Policy for employees and customers
Think about the kinds of confidential information you can have about your colleagues and customers. You may well have bank statements, customer order details, employee contracts, employee data. All the kind of information that you use in your day to day job.
Then think to yourself, would I be happy if this was mine and someone took it.
Would I be happy if someone I did not know had my bank statements, or copies of my passport that I used as part of my company on boarding process. How happy would I be if a complete stranger had my medical records.
It isn’t just the potential for embarrassment, or that breach of trust, or knowing someone knows something deeply personal about you but it is also the risk posed to identity fraud.
These physical records, papers, contracts are important. They form the basis of our lives and they should be protected.
Clear Desk Policy for the organisation
Similar to personal data there is a lot of organisational data that you probably don’t want banded about willy nilly.
It could be company banks statements, company payroll information, company pension information. Perhaps you have growth targets, or are considering redundancies. Maybe you have company formation documents or, and yes they do still exist, customer cheques waiting to be paid in. Maybe you have a payment terminal to allow you take card payments over the phone.
There is a lot of organisation information that in the wrong hands could cause repetitional damage, embarrassment potentially, financial harm and even break the law if not protected.
Clear Desk Policy for remote workers
The clear desk policy template covers and applies to remote workers. If you are writing your own policy from scratch and not using the template then you should consider that the same rules apply to remote workers. You set out the rules for securing confidential information and assets when not in use. This includes home offices where locks on offices should be considered and the use of lockable storage. Also take into account if you allow printing that a cross cut shredder may need to be provided to allow secure destruction of data.
If computer devices or sensitive documents like contracts are to be stored at a home location due to no office or storage consider restricting this to just one person and putting in additional physical security controls that takes into account the nature of what is being stored.
Often when people leave they return devices which can be a problem with no central location. We would encourage a process that does a remote wipe before the device is transported and stored which will reduce the information security risk.
ISO 27001 Clear Desk Policy FAQ
A clear desk policy is in place to provide guidance on what people should do when it comes to their desks either at home or at the office. It is not about cleaning but it is about making sure that important information and devices are secured when not in use. We do not want to leave them on desks when unattended.
Physical information should be locked away and secured when not in use.
Clear desk and clear screen are ensuring that resources of value and confidential information are secured when not in use.
The purpose of the ISO 27001 Clear Desk Policy is reduce the risk of unauthorised access, loss of and damage to information during and outside normal working hours.
The clear desk policy is the responsibility of the Chief Operating Officer (COO) or the person in charge of business operations.
It protects your organisation by placing that confidential information out of sight and out of reach when unattended
It encourages a tidy work space that can increase productivity
It ensures compliance with standards such as ISO 27001 and SOC 2
It is best practice in many organisations across the globe
It is good for the environment as it encourages digital documents over physical print outs
You don’t HAVE to but keeping a clean and tidy desk can reap productivity benefits.
Secure them, ideally in lockable storage. Keeping them in a room that can be locked is also advisable. In basic terms don’t leave them where people can easily take them.
Yes. Physical security is a requirement of the ISO 27001 certification and ISO 27001 standard and you will need to implement a clear desk policy.
It would take just over 4 hours to research and write a clear desk policy from scratch.
A clear desk policy includes guidance on what to do with physical assets and physical copies of data that need protecting. As a rule this is confidential information. It sets out what should be done.
The clear desk policy would apply to all staff and third parties that work in and for your organisation.
The clear desk policy is reviewed at least annually and also when significant change occurs.
The clear desk policy is approved and signed off by the management review team.
The clean desk policy applies to remote workers. It ensures that remote work spaces are kept clear of confidential information and that information is secured when not in use. This applies to home offices as well as remote working locations.
Your clear policy can be in whatever format works for your organisation. There are benefits to a clear desk policy PDF that are mainly about making sure that it cannot be altered and giving flexibility in who you distribute it to.
A companion policy to the clear desk policy is the physical and environmental security policy.
Examples of where the policy can fail or violations of the clear desk policy can include:
Leaving computers logged in when you are not at your desk
Leaving confidential information on a desk overnight
Leave cheques or cash unattended on a desk or in an open unlocked office
Having a payment machine left unattended
Leaving confidential printouts on a printer or next to a printer
Leaving old computers unattended or in an open unlocked space
Having old hard drives or storage media left on a desk unattended
Having confidential information in draws or cupboards but not locking them
The main consequence would be theft and loss of information or asset. This could lead to legal and regulatory fines, loss of data, loss of revenue, loss of reputation and loss of customers.
The approaches to monitoring the effectives of clear desk management include:
Doing periodic checks of offices and spaces out of hours
Doing periodic checks of offices and spaces during normal business hours
Internal audit of the clear desk process
External audit of the clear desk process
Further Reading
The ISO 27001 Clear Desk Policy satisfies the following ISO27001 Clauses and ISO27001 Annex A Controls:
ISO27001:2022 Annex A Control 7.7 Clear Desk and Clear Screen.
ISO27001:2022 Annex A Control 6.7 Remote Working.
For a more detailed guide on remote working you can read the ISO 27001 Mobile And Remote Working Policy Beginner’s Guide.