Get started
Annex A 7.7

ISO 27001 Annex A 7.7 Clear Desk and Clear Screen

Keep desks clear of sensitive papers and lock screens when away.

Control
A.7.7
Theme
Physical
Type
Administrative control
Status
Selectable via your SoA

Key takeaways

  • Keep desks clear of sensitive papers and lock screens when away.
  • Unattended desks and screens are an easy way for information to leak.
  • Start here: adopt a clear desk and clear screen policy.

Purpose

Keep desks clear of sensitive papers and lock screens when away.

Requirement

Requirement summaryClear desk rules for papers and removable storage media and clear screen rules for information processing facilities shall be defined and appropriately enforced.

Why it matters

Unattended desks and screens are an easy way for information to leak.

How to implement

  1. Adopt a clear desk and clear screen policy.
  2. Enforce automatic screen locking.
  3. Provide lockable storage and confidential waste bins.
  4. Run occasional walk-through checks.

What evidence you need to provide

Here is what you will typically need to provide for Annex A 7.7. It does not matter which system it lives in: a document, screenshot or export is fine.

Documents to have ready

  • Your clear desk and clear screen policy.
  • Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.7.7 marked as used or not used, a short reason, and its current status.

Records and examples to show

  • Results of clear desk spot checks.
  • Settings showing screens lock automatically after a short time.
  • Records of follow-up when spot checks found problems.

Things you should be able to show or explain

  • Be able to show desks and printers free of sensitive papers.

How much to show: Two or three work areas.

Common mistakes

  • Confidential papers left on desks or printers.
  • Screen lock not enforced.
  • Passwords on sticky notes.
  • Printers left with sensitive documents.
  • Tip: Auto-lock screens after a few minutes.

Policies & documents to have

  • Information Security Policy
  • Physical Security Policy

FAQ

Is A.7.7 mandatory?

Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.

What will I need to show for A.7.7?

Be ready to explain how the control works in your organisation and to provide things like: Your clear desk and clear screen policy…

← 7.6 Working in secure areas7.8 Equipment siting and protection