Clean desk policy (ISO 27001 A.7.7) with example

A clean desk policy is a short set of agreements that employees will not leave sensitive paper, USB sticks or unlocked screens unattended. In ISO/IEC 27001:2022 , this falls under control A.7.7 “Clear desk and clear screen” from Annex A. It covers two things: a tidy desk and a locked screen.

The control is simple, but during an ISO 27001 audit it is often tested in practice. An auditor walks through your office and looks at what lies on desks and printers. The NCSC (Dutch National Cyber Security Centre) also explicitly names locking your computer as a point of attention when working from home.

Short answer: a clean desk policy under ISO 27001 (A.7.7) states that sensitive information on paper and media is stored away when you leave your workplace, and that screens are locked automatically and manually. You need a short policy text, technical settings for screen locking, and evidence that you check compliance.

What does A.7.7 clear desk and clear screen require?

ISO 27001 Annex A mentions the control by title only. The elaboration is in ISO 27002:2022 . In summary, the control calls for rules for paper and removable storage media on desks, and rules for the screens of information processing equipment.

In plain language, that means:

Component	What you arrange	Example
Tidy desk	Sensitive papers and media go into a lockable cabinet or drawer	Personnel files are not left on the HR desk in the evening
Locked screen	Screens are locked when you walk away and automatically after inactivity	Windows+L when you step away, automatic lock after 5 minutes
Printers and copiers	Printouts are collected immediately, preferably with follow-me printing	The printout only comes out after you scan your badge
Meeting rooms	Whiteboards and flip charts are cleaned after use	After a client meeting, the pricing agreements are wiped from the board
Disposal	Confidential paper goes into a lockable paper bin	The bin is emptied by a certified shredding company

A.7.7 is linked to other controls. Destroying confidential paper relates to A.7.10 (storage media) and A.7.14 (secure disposal or reuse of equipment). You determine what is “confidential” with your information classification.

Example clean desk policy to adopt

Below is an example text for an organisation of about 30 employees with an office and home workers. Adjust names, deadlines and resources to your own situation. A policy that does not match what people actually do will fail at the audit.

Clean desk and clear screen policy Version 1.2, approved by the management board on 3 March 2026. Owner: information security officer.

1. Purpose. This policy prevents unauthorised people from seeing or taking confidential information at the office, at home and on the move. It applies to all employees, interns and contractors.

2. Desk. If you leave your workstation for longer than half an hour, or at the end of the day, store documents classified “internal” or higher in your lockable drawer unit. Always store USB sticks and external drives containing business information.

3. Screen. You always lock your screen when you walk away (Windows+L or Ctrl+Cmd+Q). Laptops and workstations lock automatically after 5 minutes of inactivity. This setting is enforced centrally and cannot be switched off.

4. Printing. You collect printouts immediately. You only print confidential documents via the secure print queue, which you release with your badge.

5. Meeting rooms. You erase whiteboards and take your papers with you after every meeting.

6. At home and on the move. You do not work with confidential information where others can look over your shoulder. You use a privacy filter on the train. You never leave your laptop unattended in the car.

7. Disposal. You put confidential paper in the locked paper container, not in the waste bin.

8. Checks. The information security officer carries out an unannounced round every quarter after office hours. Findings are discussed in the team meeting. Repeated breaches follow the disciplinary procedure (A.6.4).

You can include this text as a separate page in your ISMS or as a chapter in a wider code of conduct. The latter often works better in small organisations: one document that employees sign when they start.

How do you check the clean desk policy?

A policy without checks is a wish. ISO 27001 requires that you can demonstrate that controls work. For A.7.7, you do this with a simple round past the workstations, for example after 6 p.m.

Use a fixed registration form, so you can compare results over time:

Date	Location	Workstations checked	Findings	Action
12 March 2026	Utrecht office, 2nd floor	18	2 unlocked screens, 1 customer file on a desk	Spoke to the people involved personally, reminder in team meeting
11 June 2026	Utrecht office, 2nd floor	18	1 printout in the printer tray	Follow-me printing switched on for the sales department

The number of findings per round is a useful indicator for your management review. If it falls, your approach works.

What does the auditor ask for as evidence for A.7.7?

The auditor looks at both paper and practice. Expect these questions and evidence:

The policy itself, with version, date and management board approval.
Technical setting for screen locking, for example a screenshot of the policy in Intune or Group Policy.
Records of checks, such as the table above.
Communication, for example the awareness training that covers clean desk.
A walk-through of the office during the audit. If a copy of a passport lies on the printer, that is a finding.

An auditor who sees an unlocked screen with customer data during the walk-through will record it, even if your policy is perfect. So carry out a round yourself shortly before the audit.

Common mistakes with a clean desk policy

Policy only, no technology. People forget to lock their screen. A centrally enforced time-out catches that.

Forgetting home workers. A large part of the work happens at home. Include home and on-the-move situations in the same policy, or refer to your remote working and BYOD policy.

Too strict for practice. “Nothing on your desk” is unworkable for a draughtsperson with building plans. Link the rule to classification: only information from “internal” or “confidential” needs to go away.

No lockable storage. You cannot require people to store documents if there is no locked drawer unit. Arrange the resources first.

Never checking. Without rounds you have no evidence that it works. One round per quarter is enough for most SMEs.

Is a clean desk policy mandatory for ISO 27001?

Not automatically. You select Annex A controls based on your risk assessment and record the choice in your Statement of Applicability (SoA). In practice, almost no organisation excludes A.7.7. Even a fully remote company has laptops that must be locked.

Exclusion is only allowed with good justification. “We work paperless” is not a reason to drop the clear screen part.

Frequently asked questions about the clean desk policy

Does a clean desk policy also apply to home workers?

Yes. A.7.7 covers every place where you work with information. At home the risks are different: housemates, visitors, a laptop on the kitchen table. So include home working explicitly in the policy.

How quickly must a screen lock automatically?

ISO 27001 does not specify a time limit. Five to ten minutes is common for office work. Choose a shorter time for workstations where many people walk past, such as a reception desk.

Can I copy a clean desk policy?

You may use an example as a starting point. Do adapt it to your own office, resources and classification. An auditor recognises a policy that does not match practice.

More information

Annex A: all 93 controls, including the physical controls in A.7
Classifying information: decide which documents must leave the desk
Remote working and BYOD policy: agreements for working outside the office
Password policy: the other side of a locked screen
Awareness and training: how to get the policy to land
ISO 27002:2022 : the implementation guidance for A.7.7