In this ultimate how to audit guide to ISO 27001 Annex A 7.7 Clear Desk and Clear Screen, you will learn directly from an ISO 27001 Lead Auditor:
- 10 Key Audit Steps
- Verification Criteria
- Required Evidence
- The Pass / Fail Test
I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.
Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.
Table of contents
- ISO 27001 Annex A 7.7 Clear Desk and Clear Screen Audit Checklist
- 1. Clear Desk and Clear Screen Policy Formalisation Verified
- 2. Automated Screen Lock Configuration Confirmed
- 3. Physical Information Protection in Unattended Areas Verified
- 4. Secure Document Disposal Mechanism Presence Confirmed
- 5. Printer and Multifunction Device (MFD) Output Security Verified
- 6. Storage of Sensitive Media in Locked Facilities Validated
- 7. External Display and Projector Privacy Confirmed
- 8. Personnel Awareness and Compliance Confirmation Verified
- 9. Removal of Sensitive Information from Meeting Rooms Confirmed
- 10. Periodic Compliance Monitoring and Reporting Records Present
ISO 27001 Annex A 7.7 Clear Desk and Clear Screen Audit Checklist
Auditing ISO 27001 Annex A 7.6 Clear Desk and Clear Screen is a critical evaluation of physical and technical data protection hygiene in workspaces. The Primary Implementation Requirement mandates clearing sensitive media and locking active displays, ensuring the Business Benefit of preventing accidental data exposure and unauthorized visual access.
This technical verification tool is designed for lead auditors to establish the operational effectiveness of information protection in working areas. Use this checklist to validate compliance with ISO 27001 Annex A 7.6.
1. Clear Desk and Clear Screen Policy Formalisation Verified
Verification Criteria: A documented policy exists that explicitly defines the requirements for clearing sensitive information from desks and screens in line with the organisation’s risk appetite.
Required Evidence: Approved “Clear Desk and Clear Screen Policy” with evidence of recent management review and distribution.
Pass/Fail Test: If there is no formalised policy document specifically addressing clear desk and clear screen requirements, mark as Non-Compliant.
2. Automated Screen Lock Configuration Confirmed
Verification Criteria: Technical controls are active on all endpoints to automatically lock the screen after a defined period of inactivity (typically 5–15 minutes).
Required Evidence: Group Policy Object (GPO) reports or Mobile Device Management (MDM) configuration profiles showing mandatory screen-lock timeouts.
Pass/Fail Test: If a sampled workstation does not automatically lock within the policy-defined timeframe, mark as Non-Compliant.
3. Physical Information Protection in Unattended Areas Verified
Verification Criteria: Physical working areas are free from sensitive paper documents and removable storage media (USBs, external HDDs) when the workspace is unattended.
Required Evidence: Results of “after-hours” physical security sweeps or observational logs from recent internal site inspections.
Pass/Fail Test: If sensitive information (e.g. PII, passwords on sticky notes, or unencrypted media) is found on an unattended desk, mark as Non-Compliant.
