ISO 27001 Clear Desk and Clear Screen: Control A.7.7 Evidence

A clear-desk and clear-screen control is not an aesthetic rule. Its purpose is to reduce unauthorised viewing, loss, copying and damage when information is left exposed. ISO/IEC 27001:2022 Annex A control 7.7 brings paper, removable media and information-processing facilities into that risk decision.

The appropriate design depends on workplace realities. A public reception, shared operations room, private home office and restricted laboratory do not present the same exposure. The control should set understandable minimum behaviour while applying stronger measures where information or access is more sensitive.

Define the exposure the control addresses

Identify where information can be seen or taken by someone without a business need. Consider:

• documents left on desks, printers and meeting-room tables;
• unlocked screens and active remote sessions;
• whiteboards visible after meetings;
• notebooks containing credentials or customer details;
• removable media and portable devices;
• visitor routes through working areas;
• shared desks, coworking spaces and customer sites;
• home-working areas used by family or visitors; and
• screen visibility through windows or during travel.

Use information classification, legal obligations, physical access and working patterns to assess consequence and likelihood. The information-classification evidence guide can help translate sensitivity into handling rules.

Set rules people can execute

Avoid a vague instruction to keep everything clear at all times. Define what personnel must do when they leave briefly, finish for the day, use shared rooms, print sensitive material or work away from a controlled site.

A practical rule set may require:

• locking the screen whenever the device is unattended;
• automatic lock after a risk-based period of inactivity;
• collecting printed material immediately;
• storing sensitive records and removable media in approved locations;
• removing information from meeting rooms and whiteboards;
• positioning screens to reduce unauthorised viewing;
• securing authentication devices and physical keys;
• avoiding visible sensitive work in public areas; and
• reporting lost, exposed or misdirected information.

Define terms such as “unattended” and “secure storage” through examples. Personnel need to know whether a locked office is sufficient, which cabinets are approved and how rules apply during an emergency.

Combine behaviour with technical safeguards

Awareness cannot compensate for missing screen-lock configuration. Set automatic locking through managed device policy where practical, require reauthentication and monitor coverage. The inactivity period should reflect exposure, usability and compensating physical controls.

Technical safeguards may also include privacy screens, secure print release, device encryption, session controls, remote lock or wipe, and restrictions on removable media. Each measure addresses a different risk. Encryption protects a lost device’s stored data but does not protect an unlocked active session.

The UK’s National Cyber Security Centre publishes end-user device guidance covering practical protection of devices and accounts. Use external guidance as an input, then align settings with the organisation’s own risk treatment and support model.

Adapt to each working environment

Controlled offices

Map public, visitor, general staff and restricted zones. Pay attention to reception desks, shared printers, meeting rooms and windows. Storage capacity must be realistic; a rule to lock documents fails if cabinets are unavailable or keys are unmanaged.

Shared and flexible workspaces

Hot-desking increases the chance of residual papers, forgotten media and unauthorised viewing. Provide secure storage, private areas for sensitive calls, screen positioning guidance and a clear end-of-session routine. Shared display systems should close sessions and remove cached content.

Home working

The organisation cannot treat a home as a corporate office, but it can define proportionate outcomes. Personnel may need to prevent household access, store papers securely, position screens carefully and dispose of records through approved channels rather than domestic waste.

Connect these rules to the ISO 27001 remote-access policy guide and device-management controls. Escalation should be available when a home environment cannot support the required protection.

Travel and public locations

Train personnel to consider shoulder surfing, device theft, public conversations and documents visible in vehicles. Highly sensitive work may be prohibited in public settings. The rule should be based on exposure, not an assumption that every location can be made safe.

Assign ownership

Information security may define the control objective, but implementation crosses several functions:

• IT manages screen-lock and device settings;
• facilities supplies storage, zoning and printer placement;
• HR and managers communicate expectations;
• information owners define handling based on classification;
• personnel secure their immediate workspace; and
• internal audit independently evaluates operation.

Name owners for exceptions and remediation. If a technical setting cannot be applied to a legacy device, record the reason, risk, compensating measures, approver and expiry date.

Build evidence into operation

An approved policy shows intent. Auditors also need evidence that rules operate.

Design evidence

Design evidence may include risk assessments, classification-linked rules, approved workplace requirements, screen-lock configurations, secure-print design, storage specifications, responsibilities and exception criteria.

Operating evidence

Operating evidence may include device-compliance reports, secure-print records, workplace observations, awareness records, exception reviews, reported exposures, corrective actions and repeat-inspection results.

Preserve context for observations: location, date, time, area type, sample basis and condition. Do not photograph visible sensitive information merely to prove a failure. A written record can be safer and more useful.

Audit without creating theatre

Pre-announced inspections can show whether personnel know the rules, but they may not show normal operation. Combine several methods:

1. inspect a sample of work areas during ordinary activity;
2. query device settings across the managed population;
3. interview personnel in office and remote roles;
4. examine printer, storage and visitor arrangements;
5. sample exceptions and reported exposures; and
6. verify closure of earlier findings.

Select higher-risk zones and a smaller set of ordinary areas. Include different shifts or sites where practices vary. Do not use intrusive home surveillance. Remote-worker assurance can rely on configuration data, interviews, attestations, incident records and voluntary demonstrations designed with privacy in mind.

Useful audit questions include:

• How were workspace rules derived from classification and access?
• Are automatic locks applied to the intended device population?
• Where can personnel securely store information?
• How are visitors prevented from viewing working material?
• Are printer outputs protected until collected?
• How are exceptions approved and retired?
• Do repeat findings point to missing resources or unrealistic rules?

The free Annex A control lookup can help auditors connect control 7.7 with physical entry, equipment protection, information classification and remote-working controls.

Distinguish pass, partial and fail

A pass would show clear risk-based rules, enforced device settings, suitable facilities, consistent observations and managed exceptions. A partial result might show strong technical settings but insufficient storage or inconsistent meeting-room practice. A fail could involve routine exposure of sensitive records, unlocked privileged sessions or widespread noncompliance that management has not addressed.

One empty coffee cup is not an information-security finding. One visible confidential file may be significant depending on location and access opportunity. Evaluate the information, exposure, duration, recurrence and surrounding controls.

Improve the control using real signals

Track repeated observation themes, screen-lock coverage, secure-print exceptions, lost documents, exposed screens and overdue corrective actions. Analyse causes. If people leave documents out because the archive is distant or storage is full, more awareness alone will not solve the problem.

Review the control when offices are redesigned, flexible work expands, new devices are introduced or classification rules change. Coordinate with BYOD governance guidance when personal devices enter the workflow.

ISO’s official ISO/IEC 27002 page describes the standard as control guidance supporting an ISMS. Use the licensed standard for exact control language. In practice, control 7.7 succeeds when people have clear rules, usable facilities and technical support—and when evidence shows the protection persists outside audit week.