ISO 27001 A.7.7: Make clear desk and screen rules workable

What A.7.7 requires in practice

Annex A control 7.7 asks the organisation to define a clear desk rule covering papers and removable storage media, a clear screen rule covering information processing equipment, and to enforce both suitably. Three ideas matter. The rules apply when people step away, finish for the day, hand over or move between desks. They cover paper, removable media and what is visible on screens. And they are enforced to a level that suits the risk, rather than being a statement that nobody follows. The practical outputs are rules that fit how the work is actually done, suitable places to put material away, a secure disposal route, and checks that show the rules are followed. The standard does not insist on a tidy-office inspection regime or specific equipment. It aims at reducing unauthorised access, loss and accidental disclosure during ordinary work.

Focus on the information and the interruption

Examine what becomes exposed when work pauses. A printed exception report, an unlocked session, a removable drive and a meeting-room whiteboard can each retain sensitive information after their immediate purpose has ended. Decide what people should do when stepping away, handing over, moving to another desk or leaving for the day.

The rule should fit the work. A reception desk may need usable documents during a visitor interaction, but those documents should not expose another person's details. A team handling paper files needs practical storage close enough to use. If compliance requires a long trip to an inaccessible cabinet each time the telephone rings, the design is likely to fail under pressure.

Make the supporting arrangements usable

Provide suitable storage and a clear route for secure disposal. Control access to retained material rather than treating a drawer as secure merely because it closes. Consider printer collection, shared devices and the return of temporary working papers. The person producing an output needs to understand when and how it should be retrieved.

Screen protection involves behaviour and configuration. Manual locking when leaving a device can work alongside appropriate automatic locking. The setting needs to reflect the use and risk; the standard does not impose one fixed timeout for every system. During presentations, consider notifications and unrelated applications as well as the main document being shared.

Why clear desk and clear screen rules matter to the business

An unlocked screen or a printout left at a shared printer is among the cheapest ways for information to leak, and it requires no technical skill. Sensible rules cut the risk of casual disclosure to colleagues, visitors and cleaners, and reduce the exposure if a device or document is lost. Customers whose data you process, especially in open-plan or shared offices, often look for these basics. The rules also support privacy obligations for personal information. At audit, a walk around the premises quickly shows whether rules are working, so rules that people can actually follow lead to fewer findings than strict rules that are ignored.

How to implement A.7.7

Make the rules fit the work so that compliance is the easy option. Involve a few staff from each team when drafting the rules, as they know where the work gets interrupted. Avoid rules that rely on one person remembering everything at the end of a long shift.

1. Walk the working areas and note what is left out when people leave a desk, a room or a shared device.
2. Define simple rules for stepping away, leaving for the day and handing over, covering paper, media and screens.
3. Provide storage close enough to be used, with controlled access, rather than relying on a drawer that merely closes.
4. Set up secure printing or timely collection arrangements, and a clear route for disposing of waste paper.
5. Include shared spaces such as meeting rooms and whiteboards, and agree who clears them.
6. Explain the reasons for the rules during awareness sessions, using situations familiar to each team.
7. Carry out occasional walkthroughs, give feedback and adjust rules where they prove unworkable.

Illustrative BPO example: a shift handover at shared desks

Illustrative construction example: confidential notes in a meeting cabin

A hypothetical contractor holds a tender discussion in a project meeting cabin later used by subcontractors. The team removes printed packs but leaves pricing notes on the whiteboard and a presentation open on the room computer. The next booking has legitimate access to the room, but not to that information.

The host takes responsibility for clearing temporary displays and ending the session before handing over the cabin. Required business records are preserved through the controlled record process rather than erased indiscriminately. A walkthrough using harmless sample material checks the whiteboard, screen and printer output. It also tests a last-minute room change, where the usual end-of-meeting routine is easier to forget.

Apply the rule beyond the end-of-day inspection

Exposure occurs during short absences and transitions, not only overnight. Consider shared screens, client demonstrations and remote meetings where notifications may reveal information to a different audience. Explain the purpose so people can recognise a new situation, rather than memorise a narrow instruction about desks.

When a team vacates premises, a final review should consider material in cupboards, behind furniture and on shared equipment. This is different from routine housekeeping. A move may leave information behind even though staff have transferred their current work. Assign responsibility and an appropriate check before the organisation gives up control of the space.

Evidence and proportionate enforcement

Common nonconformities with A.7.7

Walkthroughs usually reveal the same patterns. Most are found simply by walking round the premises after normal hours, which is exactly when auditors and visitors sometimes do so, and they are cheap to fix once noticed.

• Unlocked workstations left unattended in open-plan areas.
• Printouts remaining at shared printers or on desks after working hours.
• Removable drives left on desks with no storage or log.
• Confidential material discarded in ordinary waste bins.
• A written clear desk rule that cannot be followed because suitable storage was never provided.