ISO 27001 Annex A 7.7 Clear Desk and Clear Screen is an ISO 27001 control that requires an organisation to secure information on desks, screens and other accessible areas.
In this guide you will learn how to implement ISO 27001 Annex A 7.7 and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.
Table of contents
- Purpose & Definition
- ISO 27001 Annex A 7.7 Training Video
- Implementation Guide
- How to implement ISO 27001 Annex A 7.7
- ISO 27001 Clear Desk and Clear Screen Policy
- How to pass the audit
- What the auditor will check
- Top 3 mistakes and how to avoid them
- ISO 27001 Annex A 7.7 FAQ
- Related ISO 27001 Controls
- ISO 27001 Controls and Attribute Values
Purpose & Definition
ISO 27001 Annex A 7.7 Clear Desk And Clear Screen is a preventive control that ensures you address the risks of unauthorised access, loss of and damage to information on desks, screens and in other accessible locations during and outside normal working hours.
The ISO 27001 standard defines Clear Desk And Clear Screen as:
Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities should be defined and appropriately enforced.
ISO 27001:2022 Annex A 7.7 Clear Desk and Clear Screen
DO IT YOURSELF ISO27001
Stop Spanking £10,000’s on Consultants and Platforms
ISO 27001 Annex A 7.7 Training Video
In this free training video you will learn How to implement ISO 27001 Clear Desk and Clear Screen (Annex A 7.7) and Pass Your Audit.
Implementation Guide
General Guidance
This is a straight forward control to implement. Be sure that IT have set it so that screens auto lock after a short period of time of no activity. Provide lockable storage to locations where confidential information will be stored. This could be paper or even devices and machines that are in storage whilst not allocated or in use. Consider home workers and for those home workers that do require this level of storage then provide it to them and provide them with shredders.
If you have a situation that you are permanently leaving a location having a process of someone doing a final sweep and check of the facility is good practice. It can be that papers fall behind cupboards or draws.
Provide Lockable Storage
To enable people to maintain a clear desk it is good practice to provide lockable storage. This will be based on business need and risk but examples of where lockable storage could be required:
- People who print, use and need to store confidential data
- People use and need to store confidential devices such as payment devices, card readers, devices that are not in use.
- People that work from home
- Directors
- Shareholders
The level of security that the device provides will be based on risk and business need but as a minimum it should be lockable. Other considerations include
- Fireproof
- The level of locks
- Backup keys or access
Enable Auto Screen Locking
To facilitate a clear screen it is now common practice to implement auto locking of screens after a set period of time. Whether managed centrally or per device, auto locking should be enabled with a recommendation of activating after 60 seconds or based on your risk assessment and business need.
Provide Guidelines and Training
Once you deploy the policy it is best practice to continue to train and educate people on clear desk and clear screen and what the requirements are.
Secure Printers
Printers represent a big risk to information security as they are often located away from users and in easy to access locations. It can be the case that printouts are left for long periods unattended and uncollected.
Consider printers with authentication functions so print outs can only be produced when the person is next to the printer.
Areas around printers should be checked on a regular basis and discarded print outs are destroyed securely in line with policy.
How to implement ISO 27001 Annex A 7.7
Implementing ISO 27001 Annex A 7.7 ensures that sensitive information is protected from unauthorised access by maintaining tidy physical and digital environments.
1. Formalise the Clear Desk and Clear Screen Policy
Establish a documented policy that defines mandatory standards for all employees and contractors to ensure a consistent approach to information confidentiality.
- Define the scope to include all physical desks, meeting rooms, and digital workstations.
- Detail the specific requirements for securing hard copy documents and removable media when workstations are unattended.
- Ensure the policy is signed off by leadership and integrated into the Information Security Management System (ISMS).
2. Provision Technical Screen Lock Controls
Deploy automated technical safeguards to ensure that digital sessions are terminated or secured when a user is not present.
- Configure Group Policy Objects (GPO) or Mobile Device Management (MDM) profiles to enforce an automatic screen lock after a maximum of five minutes of inactivity.
- Mandate Multi-Factor Authentication (MFA) or secure biometric prompts for unlocking active user sessions.
- Enable session timeout limits for sensitive applications and web-based portals to reduce the window of vulnerability.
3. Procure and Distribute Lockable Physical Storage
Equip the workforce with the necessary physical infrastructure to protect sensitive assets and paper records when not in use.
- Provision lockable pedestals, cabinets, or lockers for every member of staff to secure classified documents and hardware.
- Implement a master key management process or digital locker access log to maintain a secure chain of custody.
- Encourage the use of cross-cut shredders or secure waste consoles for the disposal of sensitive paper records.
4. Secure Shared Output Devices and Visual Aids
Control the physical output of sensitive information to prevent unauthorised viewing by visitors or unauthorised personnel.
- Enable “Follow-Me” printing or PIN-authenticated release on all printers to ensure documents are only printed when the user is present.
- Position computer monitors and whiteboards away from ground-floor windows or high-traffic corridors to mitigate visual eavesdropping.
- Formalise the immediate clearing of meeting room whiteboards and the removal of abandoned printouts.
5. Execute Compliance Audits and Record Results
Perform regular inspections to verify adherence to the policy and gather evidence for internal and external ISO 27001 audits.
- Conduct unannounced “floor walks” after hours to identify and log instances of left-out documents or unlocked screens.
- Review MDM and GPO reports to verify that technical lock settings are active on all endpoint devices.
- Document corrective actions taken for non-compliance within the ISMS to demonstrate continuous improvement.
6. Formalise Security Awareness Training
Ensure that all personnel understand their responsibilities regarding physical security and the technical shortcuts used to protect data.
- Execute training sessions that highlight the risks of “shoulder surfing” and the legal implications of a data breach.
- Integrate Clear Desk and Clear Screen requirements into the mandatory onboarding induction for new starters.
- Utilise internal communications to remind staff of the “Windows + L” or “Cmd + Ctrl + Q” lock shortcuts.
ISO 27001 Clear Desk and Clear Screen Policy
To communicate to people what you do and what is expected you are going to write, sign off, implement and communicate your topic specific ISO 27001 Clear Desk and Clear Screen Policy.
How to pass the audit
To pass the audit of ISO 27001 Annex A 7.7 you are going to
- Implement a topic specific clear desk policy
- Provide lockable storage to locations and people that need to store physical confidential and sensitive information
- Implement auto locking and/or auto log out for end users
- Put in place processes for printing that reduce the likelihood or printouts being left un collected.
For more guidance on the clear desk policy read the ISO 27001 Clear Desk Policy Beginner’s Guide
What the auditor will check
The audit is going to check a number of areas. Lets go through the main ones
1. That your devices auto lock
They will check for evidence that end user devices with auto log out or auto lock after a short period of time.
2. Lockable storage
The auditor is going to look for situations where confidential and sensitive information is required in physical form, that could be paper or devices, and they are going to check that you lock it away. This will be in offices but watch out as they will also check this for remote workers.
Top 3 mistakes and how to avoid them
The top 3 mistakes people make for ISO 27001 Clear Desk And Clear Screen are
1. Your devices don’t auto lock
This is something that people sometimes turn off. Developers and technical people are the worst culprits for this. Make sure that if this is set and you expect it to be in place that you check this before the audit. As a minimum ensure you check on the devices of the people that are going to be audited.
2. You don’t have lockable storage
The number of times we see old laptops, archive boxes of information just lying around in meeting rooms, common areas and even kitchens. My advice would be to do some house keeping and stop storing things just in case but as a minimum get it locked away. Also to consider home and remote workers. If they receive company related post or store devices at these locations then provide them with lockable storage. Remote workers are always overlooked.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Annex A 7.7 FAQ
Yes, Annex A 7.7 is a required control in the 2022 standard, meaning organisations must define and enforce rules for clearing sensitive information from workspaces.
Hard-copy information and removable storage media must be locked away when not in use.
Sensitive documents must be cleared from desks at the end of the working day.
Printers and whiteboards must be cleared of sensitive data immediately after use.
The policy should be applied to office-based, remote, and home-working environments.
Implementing a Clear Screen policy involves combining technical automated controls with employee awareness to ensure digital information is never left exposed.
Auto-Lock: Configure a mandatory screen-saver lock after a maximum of 5–10 minutes of inactivity.
Manual Lock: Train employees to use the ‘Windows Key + L’ or ‘Command + Control + Q’ shortcut every time they leave their desk.
Privacy Filters: Use physical screen filters in high-traffic areas or public spaces.
Termination: Ensure active sessions are terminated when the user finishes their task or leaves the facility.
Yes, the scope of ISO 27001 Annex A 7.7 extends to any location where organisational information is processed, including home offices and public spaces.
Remote workers should ensure screens are not visible to family members or visitors.
Physical documents used at home must be stored in a lockable cabinet or drawer.
Sensitive information should be shredded rather than placed in general domestic waste.
VPN and session timeouts should be strictly enforced on remote hardware.
Auditing compliance requires regular, documented physical “walk-throughs” and technical configuration checks to verify that policies are being followed.
Conduct unannounced “after-hours” desk checks to identify left-out documents or media.
Review Active Directory or MDM policies to confirm auto-lock timers are correctly configured.
Use employee awareness quizzes to test understanding of the policy.
Document findings in an internal audit report to serve as evidence for certification auditors.
Related ISO 27001 Controls
- ISO 27001 Annex A 6.1 Screening
- ISO 27001 Annex A 7.1 Physical Security Perimeters
- ISO 27001 Annex A 7.10 Storage Media
ISO 27001 Controls and Attribute Values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Confidentiality | Protect | Physical security | Protection |
| Integrity | ||||
| Availability |
Stuart Barker
ISO 27001 Ninja
Stuart Barker is a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
As a qualified ISO 27001 Lead Auditor, Stuart possesses distinct insight into the specific evidence standards required by certification bodies. His toolkits represent an auditor-verified methodology designed to minimise operational friction while guaranteeing compliance.
- MSc Security
- ISO 27001 Lead Auditor
- 30+ Years Exp
- Ex-GE Leader