Control A.7.7Clear desk and clear screen
Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities must be defined and appropriately enforced.
One of the oldest controls in the standard and still one of the most frequently observed failures, because it depends entirely on habit.
The rules themselves are straightforward: sensitive material put away when unattended, screens locked, removable media secured. Enforcement is what distinguishes implementation from aspiration, and enforcement here means routine, visible checking rather than sanction — a walkthrough that finds and reports is worth more than a policy that threatens.
Remote and hybrid working extends the control past the office, where “enforcement” is not available and the organisation is relying on A.6.7’s measures and on people understanding why the rule exists.
Screen locking should be automatic as well as expected: a timeout set centrally removes the dependence on memory, which is the only part of this control that can be engineered rather than encouraged.
How to put this in place
Information left on desks and screens is easy to read or take. The project needs a rule that people follow and someone checks, rather than a policy nobody tests.
- Write a clear desk and clear screen rule covering paper, screens and printouts.
- Enforce screen locking after a few minutes through device settings.
- Provide lockable storage and secure print release.
- Brief staff, including home and shared-space workers.
- Walk the offices out of hours and record what you find.
Evidence an auditor usually looks for: screen lock settings, secure printing configuration, and clear desk walk-round results with follow-up.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.