ISO 27001 Annex A 7.7 Clear desk and clear screen policies
What it says
Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities shall be defined and appropriately enforced.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure desks and screens are clear of sensitive info to prevent unauthorised access.
This control is like making sure you don't leave important stuff lying around in plain sight, like your diary open on the kitchen table. It matters because if someone sees your private notes, they might misuse that information. Keeping desks and screens clear of sensitive info prevents unauthorised people from seeing or accessing it, protecting your important data and your organisation's reputation.
Free. Save your status, tasks and notes.
Why it matters
Sensitive information left visible on desks or screens can be accessed by unauthorised people, causing data leakage, compliance breaches and reputational damage.
How to implement
The IT manager should implement a clear screen policy by configuring all computers to automatically lock the screen after a short period of inactivity, such as 5 minutes.
This can be done through system settings or group policies in the network. Explain to staff that this helps keep confidential information out of sight when they are away from their desks.
Human Resources should develop and share clear desk rules with all employees.
These rules should encourage employees to tidy their desks before leaving, making sure any papers with sensitive information are locked away securely. This helps protect data from being seen by unauthorised visitors or cleaning staff.
Office Managers should ensure that storage solutions like filing cabinets or safes are available and used for keeping important documents or removable media secure.
These should have locks, and employees should be reminded to use them, especially at the end of the day or after a meeting to comply with the Privacy Act 1988.
Procurement should choose printers that have secure printing features, like printing only when the user is present to release the document.
This reduces the risk of sensitive documents being picked up by others.
The board should support training sessions that explain the importance and the simple do's and don'ts of clear desk and screen policies.
Encourage employees to regularly clear whiteboards and shared displays of any critical information once meetings conclude.
Keep it running
Run periodic spot checks and reminders: lock screens when away, clear papers/removable media from desks, and store items in locked cabinets at day end.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The clear desk and clear screen policy document.
Look at
Whether it covers both paper documents and electronic displays and is communicated to all employees.
Good evidence
A detailed policy with examples and a sign-off sheet showing staff have acknowledged it.
- Check 2 of 5What an auditor asks for
Ask for
Records of staff training on the clear desk and screen policy.
Look at
The attendance logs and training content.
Good evidence
A comprehensive training program attended by all staff with regular refreshers.
- Check 3 of 5What an auditor asks for
Ask for
To see the automatic screen lock settings on company computers.
Look at
The configurations on multiple machines to ensure compliance.
Good evidence
A standardised setup where computers lock after 5 minutes of inactivity.
- Check 4 of 5What an auditor asks for
Ask for
About procedures for securing printers and related devices.
Look at
Whether printers have authentication features activated.
Good evidence
A documented process where only intended users can collect their printouts.
- Check 5 of 5What an auditor asks for
Ask for
Inspection reports of physical office sweeps after hours.
Look at
The reports to check for compliance with removing sensitive materials.
Good evidence
Regular documented checks with results showing no sensitive information left unsecured.
Mappings
Closest match in ASD Information Security Manual: ISM-1888, Ensure mobile devices have secure lock screens, which this control covers in full and more.
ASD Information Security Manual: 9 mappings
This control is broader than ISM-1888.
Annex A 7.7 mandates clear screen policies to ensure unattended information processing facilities do not display sensitive information. ISM-1888 requires mobile devices to have secure lock screens, which is an element of a clear screen policy by blocking unauthorized viewings when a device is idle. Annex A 7.7 has a broader enforcement scope across all workstations and facilities.
This control partially overlaps ISM-0161.
ISM-0161 requires IT equipment and media to be secured when not in use, with an emphasis on preventing unauthorised access to physical assets and storage media. ISO/IEC 27001:2022 Annex A 7.7 relates by mandating clear desk and clear screen rules, including secure handling of removable storage media when unattended. Annex A 7.7 also covers information visibility on screens and paper handling, while ISM-0161 is broader across all unused IT equipment and media regardless of desk/screen context.
This control partially overlaps ISM-0164.
ISM-0164 requires preventing unauthorised people from observing system displays and keyboards within facilities. ISO/IEC 27001:2022 Annex A 7.7 mandates clear screen rules (and clear desk) to reduce exposure of information on displays when unattended, which addresses a key scenario of unauthorised viewing. ISM-0164 additionally covers physical observation risks even while a user is present (e.g. shoulder surfing and keyboard observation), whereas A 7.7 focuses on procedural display/desk hygiene.
This control partially overlaps ISM-0831.
ISM-0831 requires media to be handled in a manner appropriate to its sensitivity or classification. Annex A 7.7 overlaps by requiring clear desk and clear screen rules for papers and removable storage media, which is one concrete way to prevent exposure or loss of sensitive media. Annex A 7.7 is narrower and environment/behaviour specific (work areas and screens), while ISM-0831 covers broader handling expectations for media in general (e.g. transport, custody, and storage consistent with classification).
This control partially overlaps ISM-0866.
ISM-0866 requires that sensitive or classified data is not viewed on mobile devices in public locations unless steps are taken to reduce shoulder-surfing risk. Annex A 7.7 requires defined and enforced clear screen rules to prevent unauthorised viewing of information on screens in general. They overlap on preventing visual disclosure via screens, but ISM-0866 is specifically about mobile devices in public, while Annex A 7.7 is broader and typically focuses on workplaces and unattended terminals (e.g. locking screens).
This control partially overlaps ISM-0870.
ISM-0870 requires mobile devices to be carried or stored in a secured state when not being actively used to reduce the risk of unauthorised access. This overlaps with Annex A 7.7 because clear screen rules commonly require locking screens when unattended, which is a practical way to keep a mobile device in a secured state. Annex A 7.7 is broader in that it also covers papers and removable media (clear desk) and applies to information processing facilities generally, not specifically mobile device storage/handling.
This control partially overlaps ISM-1145.
ISM-1145 requires privacy filters on SECRET and TOP SECRET mobile device screens to reduce the risk of unauthorised viewing. ISO/IEC 27001:2022 Annex A 7.7 establishes and enforces clear screen rules to prevent sensitive information being visible when users leave devices unattended or in shared environments. Both reduce visual exposure of sensitive information on screens, but ISM-1145 mandates a specific protective mechanism for classified mobile devices whereas Annex A 7.7 focuses on behavioural and procedural controls across information processing facilities.
This control partially overlaps ISM-1359.
ISM-1359 requires an organisation to establish and maintain a removable media usage policy covering safe handling and use of removable storage. Annex A 7.7 requires clear desk and clear screen rules, explicitly including requirements for papers and removable storage media to reduce exposure and loss. The overlap is in governing secure handling of removable media, but Annex A 7.7 is focused on workspace hygiene/enforcement whereas ISM-1359 is broader policy coverage for removable media usage across contexts (e.g. approval, transport, connection and storage rules).
This control partially overlaps ISM-2012.
Annex A 7.7 requires organisations to define and enforce clear screen rules (and clear desk rules) to prevent unauthorised access to information left accessible at workstations. ISM-2012 relates directly by mandating specific technical screen-lock behaviours (timeout, concealment, re-authentication, and preventing user disablement) that enforce clear screen expectations on systems. The ISO control is broader because it also covers clear desk requirements (papers and removable media) and allows non-technical enforcement measures, while ISM-2012 is a prescriptive system configuration control focused on screen locking.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation