ISO 27001 A.7.7: Clear desk and clear screen

Write a clear desk and clear screen policy that is practical for your environment. Make it specific enough to be enforceable. For clear desk: sensitive documents go into locked storage when not being actively used, desks must be cleared of all sensitive materials at end of day, printers and copiers must be cleared immediately after use (or use secure print release), removable media gets locked away, whiteboards in meeting rooms get wiped after meetings, and sensitive waste goes in shredders or secure destruction bins - not regular waste bins. For clear screen: computers must be locked when the user leaves their desk, automatic screen lock must kick in after a defined idle period (5-10 minutes is standard), sensitive information should not be displayed where unauthorised people can see it, privacy screens should be used in open-plan areas and near windows, and remote desktop sessions should be disconnected when not in use. Enforce the screen lock technically. Use group policy or endpoint management to set automatic lock after 5 minutes for devices in open areas, up to 10-15 minutes for private offices. Make sure the lock requires re-authentication. Do not rely on people remembering to lock manually - enforce it at the system level. Provide the infrastructure people need to comply. Every workstation needs lockable drawers or a cabinet. Put shredders and secure destruction bins in convenient locations - if people have to walk across the building, they will not bother. Set up secure print so documents only release when someone authenticates at the printer. Audit compliance regularly. Walk through office areas after hours and check for sensitive materials on desks, documents in printer trays, and unlocked screens. Document findings. Share anonymised results with the organisation. Address repeat offenders through awareness training first, then the disciplinary process if it continues.