ISO 27001 Annex A 7.7 Clear Desk and Clear Screen Explained

ISO 27001 Clear Desk and Clear Screen

ISO 27001 Annex A 7.7 Clear Desk and Clear Screen is an ISO 27001 control that  requires an organisation to secure information on desks, screens and other accessible areas.

Key Takeaways

ISO 27001 Annex A 7.7 requires organisations to define and enforce clear desk and clear screen rules to protect information from unauthorized access, loss, or damage. This control applies both during and outside of normal working hours and is a fundamental physical security measure. The goal is simple: ensure that confidential data (on paper or on screen) is never left exposed when a workstation is unattended.

Purpose

ISO 27001 Annex A 7.7 Clear Desk And Clear Screen is a preventive control that ensures you address the risks of unauthorised access, loss of and damage to information on desks, screens and in other accessible locations during and outside normal working hours.

Definition

The ISO 27001 standard defines Clear Desk And Clear Screen as:

Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities should be defined and appropriately enforced.

ISO 27001:2022 Annex A 7.7 Clear Desk and Clear Screen

Explanation

The focus for this ISO 27001 Control is information on desks, screens and areas outside normal working hours. As one of the ISO 27001 controls this is about locking confidential information away out of hours.

Requirement

• Auto-Locking Screens: You must configure all user devices to automatically lock after a short period of inactivity (typically 1 to 5 minutes).
• Lockable Storage: You should provide lockable drawers or cabinets for employees who handle sensitive physical documents or removable media (like USBs and external hard drives).
• Secure Printing: Printers are a high-risk area. Use “Follow-Me” printing or PIN-based release to ensure documents aren’t left sitting in the output tray for anyone to see.
• Meeting Room Hygiene: Whiteboards must be wiped clean after every meeting, and sensitive documents must not be left behind in common areas or kitchens.
• Remote Work Responsibility: The clear desk policy also applies to home and remote workers. If employees handle company mail or physical devices at home, they must have a way to secure them.

Audit Focus

1. The Floor Walk: They will walk through your office (or ask for a video walk-through) to look for post-it notes with passwords, unlocked screens, or sensitive files sitting on desks.
2. Configuration Check: They will ask to see the “Auto-Lock” settings on a random employee’s laptop to verify it matches your policy.
3. Physical Evidence: They will check if your “Locked Shredding Bins” are actually locked and if the keys to storage cabinets are not just left in the locks.

FREE Training Video

Guidance

This is a straight forward control to implement. Be sure that IT have set it so that screens auto lock after a short period of time of no activity. Provide lockable storage to locations where confidential information will be stored. This could be paper or even devices and machines that are in storage whilst not allocated or in use. Consider home workers and for those home workers that do require this level of storage then provide it to them and provide them with shredders.

If you have a situation that you are permanently leaving a location having a process of someone doing a final sweep and check of the facility is good practice. It can be that papers fall behind cupboards or draws.

Provide Lockable Storage

To enable people to maintain a clear desk it is good practice to provide lockable storage. This will be based on business need and risk but examples of where lockable storage could be required:

• People who print, use and need to store confidential data
• People use and need to store confidential devices such as payment devices, card readers, devices that are not in use.
• People that work from home
• Directors
• Shareholders

The level of security that the device provides will be based on risk and business need but as a minimum it should be lockable. Other considerations include

• Fireproof
• The level of locks
• Backup keys or access

Enable Auto Screen Locking

To facilitate a clear screen it is now common practice to implement auto locking of screens after a set period of time. Whether managed centrally or per device, auto locking should be enabled with a recommendation of activating after 60 seconds or based on your risk assessment and business need.

Provide Guidelines and Training

Once you deploy the policy it is best practice to continue to train and educate people on clear desk and clear screen and what the requirements are.

Secure Printers

Printers represent a big risk to information security as they are often located away from users and in easy to access locations. It can be the case that printouts are left for long periods unattended and uncollected.

Consider printers with authentication functions so print outs can only be produced when the person is next to the printer.

Areas around printers should be checked on a regular basis and discarded print outs are destroyed securely in line with policy.

How to implement it

Implementing ISO 27001 Annex A 7.17 (formerly 7.7) ensures that sensitive information is protected from unauthorised access by maintaining tidy physical and digital environments. This technical workflow minimises the risk of data breaches caused by visual interception or opportunistic theft in office, remote, and public settings.

1. Formalise the Clear Desk and Clear Screen Policy

Establish a documented policy that defines mandatory standards for all employees and contractors to ensure a consistent approach to information confidentiality.

• Define the scope to include all physical desks, meeting rooms, and digital workstations.
• Detail the specific requirements for securing hard copy documents and removable media when workstations are unattended.
• Ensure the policy is signed off by leadership and integrated into the Information Security Management System (ISMS).

2. Provision Technical Screen Lock Controls

Deploy automated technical safeguards to ensure that digital sessions are terminated or secured when a user is not present.

• Configure Group Policy Objects (GPO) or Mobile Device Management (MDM) profiles to enforce an automatic screen lock after a maximum of five minutes of inactivity.
• Mandate Multi-Factor Authentication (MFA) or secure biometric prompts for unlocking active user sessions.
• Enable session timeout limits for sensitive applications and web-based portals to reduce the window of vulnerability.

3. Procure and Distribute Lockable Physical Storage

Equip the workforce with the necessary physical infrastructure to protect sensitive assets and paper records when not in use.

• Provision lockable pedestals, cabinets, or lockers for every member of staff to secure classified documents and hardware.
• Implement a master key management process or digital locker access log to maintain a secure chain of custody.
• Encourage the use of cross-cut shredders or secure waste consoles for the disposal of sensitive paper records.

4. Secure Shared Output Devices and Visual Aids

Control the physical output of sensitive information to prevent unauthorised viewing by visitors or unauthorised personnel.

• Enable “Follow-Me” printing or PIN-authenticated release on all printers to ensure documents are only printed when the user is present.
• Position computer monitors and whiteboards away from ground-floor windows or high-traffic corridors to mitigate visual eavesdropping.
• Formalise the immediate clearing of meeting room whiteboards and the removal of abandoned printouts.

5. Execute Compliance Audits and Record Results

Perform regular inspections to verify adherence to the policy and gather evidence for internal and external ISO 27001 audits.

• Conduct unannounced “floor walks” after hours to identify and log instances of left-out documents or unlocked screens.
• Review MDM and GPO reports to verify that technical lock settings are active on all endpoint devices.
• Document corrective actions taken for non-compliance within the ISMS to demonstrate continuous improvement.

6. Formalise Security Awareness Training

Ensure that all personnel understand their responsibilities regarding physical security and the technical shortcuts used to protect data.

• Execute training sessions that highlight the risks of “shoulder surfing” and the legal implications of a data breach.
• Integrate Clear Desk and Clear Screen requirements into the mandatory onboarding induction for new starters.
• Utilise internal communications to remind staff of the “Windows + L” or “Cmd + Ctrl + Q” lock shortcuts.

Clear Desk Checklist

Item	Allowed on Desk?	Action Required
Family Photos	✅ Yes	None.
Post-it Notes	❌ NO	Shred or lock in drawer.
Notebooks	❌ NO	Lock in drawer when away.
USB Drives	❌ NO	Lock in drawer.
Keys	❌ NO	Keep on person.
Whiteboard	❌ NO	Wipe clean after every meeting.

ISO 27001 Clear Desk and Clear Screen Policy

To communicate to people what you do and what is expected you are going to write, sign off, implement and communicate your topic specific ISO 27001 Clear Desk and Clear Screen Policy.

How to pass the audit

To pass the audit of ISO 27001 Annex A 7.7 you are going to

• Implement a topic specific clear desk policy
• Provide lockable storage to locations and people that need to store physical confidential and sensitive information
• Implement auto locking and/or auto log out for end users
• Put in place processes for printing that reduce the likelihood or printouts being left un collected.

For more guidance on the clear desk policy read the ISO 27001 Clear Desk Policy Beginner’s Guide

What the auditor will check

The audit is going to check a number of areas. Lets go through the main ones

1. That your devices auto lock

They will check for evidence that end user devices with auto log out or auto lock after a short period of time.

2. Lockable storage

The auditor is going to look for situations where confidential and sensitive information is required in physical form, that could be paper or devices, and they are going to check that you lock it away. This will be in offices but watch out as they will also check this for remote workers.

Top 3 mistakes and how to avoid them

The top 3 mistakes people make for ISO 27001 Clear Desk And Clear Screen are

1. Your devices don’t auto lock

This is something that people sometimes turn off. Developers and technical people are the worst culprits for this. Make sure that if this is set and you expect it to be in place that you check this before the audit. As a minimum ensure you check on the devices of the people that are going to be audited.

2. You don’t have lockable storage

The number of times we see old laptops, archive boxes of information just lying around in meeting rooms, common areas and even kitchens. My advice would be to do some house keeping and stop storing things just in case but as a minimum get it locked away. Also to consider home and remote workers. If they receive company related post or store devices at these locations then provide them with lockable storage. Remote workers are always overlooked.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

Applicability across different business models.

Business Type	Applicability	Examples of Control Implementation
Small Businesses	Applies to daily office hygiene and ensuring that simple physical mistakes don’t lead to data exposure. The goal is to build a culture where information is locked away before staff leave for the day.	Enforcing a policy that all whiteboards must be wiped clean at the end of every meeting. Providing lockable desk pedestals for staff to store notebooks and company-issued mobile phones overnight. Configuring all office laptops to auto-lock after 2 minutes of inactivity to prevent unauthorized viewing by visitors.
Tech Startups	Critical for managing remote and hybrid teams. Compliance involves extending physical security rules to home offices and ensuring that digital “desks” (desktops) are managed via technical automation.	Using MDM tools (like Intune or Jamf) to enforce a mandatory 5-minute screen lock across the entire remote workforce. Providing home workers with cross-cut shredders to securely dispose of company-related mail or draft notes. Restricting the use of “Post-it” notes for password storage through regular security awareness quizzes and reminders.
AI Companies	Vital for protecting proprietary model IP and sensitive training metadata. Focus is on preventing visual eavesdropping in high-performance research environments.	Distributing physical privacy screen filters to data scientists working in open-plan co-working spaces. Implementing “Follow-Me” printing to ensure that sensitive research papers are only printed when the user is at the printer. Conducting unannounced after-hours “floor walks” to verify that no high-sensitivity model diagrams are left on desks or monitors.

FAQ

Related ISO 27001 Controls

• ISO 27001 Annex A 6.1 Screening
• ISO 27001 Annex A 7.1 Physical Security Perimeters
• ISO 27001 Annex A 7.10 Storage Media

ISO 27001 Controls and Attribute Values

Control type	Information security properties	Cybersecurity concepts	Operational capabilities	Security domains
Preventive	Confidentiality	Protect	Physical security	Protection
	Integrity
	Availability

About the author