ISO 27001 Annex A 7.7: clear desk and clear screen without policing

The auditor is walking to the first interview. On the way past the open-plan desks, a laptop sits unlocked and a printout waits in the printer tray. That is a finding before a single question has been asked.

This guide shows how to meet ISO 27001 Annex A 7.7 without turning the office into a patrol: an enforced screen lock, a few small purchases for paper and print, and a ten-minute monthly walk-round. It is written for security managers and IT leads at regulated firms of 25 to 250 staff, with engineers who want exemptions and half the team working from home.

What does ISO 27001 Annex A 7.7 require?

ISO 27001 Annex A 7.7 requires written, communicated and genuinely enforced rules that keep sensitive information from sitting exposed on desks, screens and shared surfaces such as printers and whiteboards. The rules live in a topic-specific policy under Annex A 5.1, and a section within your security policy satisfies that at this scale.

The control has two halves. The desk half covers paper, media, printers and whiteboards. The screen half is endpoint security, and at most modern firms that is where the bulk of the control lives, enforced through the same device estate you manage under Annex A 8.1.

Inside secure areas such as a server room, Annex A 7.6 picks up the same discipline. For everywhere else, the ICO physical security toolkit guidance sets the practical baseline: document clear desk and clear screen requirements, communicate them to all staff and set screens to lock automatically after an appropriate period. It also recommends regular physical checks that staff follow the rules, which is the job of the walk-round described below.

That section should cover:

• paper and media storage
• screen locking
• printing
• whiteboards and meeting rooms
• notification suppression when presenting
• the remote-work expectation

Approve and communicate it like any other topic policy, and ask new starters to acknowledge it during onboarding so the communication trail exists. What matters to an auditor is that the section matches what people actually do.

The control is preventive and concerns confidentiality only: an observed screen discloses information, it does not corrupt it. The stakes are still visible. Prospects touring the office, an enterprise customer's due-diligence team and the certification auditor all notice an unlocked screen, and they read it as your real security culture whatever the policy pack says. For a regulated firm, one HR letter or one glimpse of a client dashboard becomes a reportable-event conversation.

How do you enforce the screen lock centrally rather than relying on people?

Push an inactivity lock to every device through your MDM platform or Group Policy, with a timeout of a few minutes and normal authentication to unlock. The timer is the control; locking on walk-away is a bonus habit. Users should not be able to switch it off, and any exception must be recorded and time-boxed.

This is an hour's work, because the lock rides on the baseline that already configures your endpoints. The sequence is short:

1. Choose the timeout. A few minutes of inactivity is the widely accepted band: short enough to close the walk-away window and long enough not to fight your users.
2. Push it to every managed device. Laptops, desktops and, where you manage them, phones all take the same profile.
3. Remove the off switch. Users cannot change or disable the timer from their settings.
4. Require normal authentication to unlock. No special bypass, no shared PIN.
5. Teach the lock shortcut. Make locking on walk-away the cultural default, knowing the timer backs it up.

Then the engineers arrive. Developers and administrators ask to be exempted because the lock interrupts long builds and debugging sessions. They are also the accounts with the most access, which makes them the first place an auditor looks.

An exemption list with no expiry dates is a register of standing holes in your highest-privilege accounts.

A real need gets a ticketed, time-boxed exception instead: a named approver, a short expiry and a compensating control, such as the device sitting in a locked room. When the date passes, the exception lapses or is re-approved on purpose. At this scale, one baseline and one exceptions register show auditors and enterprise customers that the control is enforced rather than hoped for.

How do you stop screen shares and meeting rooms leaking client data?

Presenters should share a single application window rather than the whole desktop, and switch on do-not-disturb before any screen share or meeting-room display. That suppresses the pop-up notifications that expose client names and messages. One line in the policy and one demonstration during onboarding make it the default behaviour.

A notification preview shows a sender's name and the first line of a message. Shared to a customer call or a wall display, it hands that detail to everyone watching, and the presenter often never sees it. Window sharing also keeps open mail and chat out of view.

Meeting rooms need the habit as much as customer calls do. A laptop plugged into a big-room display shows its banners to every visitor in the room, and to anyone walking past a glass wall.

The onboarding demonstration works best on the new starter's own laptop: switch on do-not-disturb, share one window, and show what the audience would have seen without either. It sticks better than a paragraph in a handbook.

Where a presenter regularly demonstrates from live client systems, prepare a demo workspace in advance so nothing sensitive is open in the first place. This is one of the few spots where behaviour, not configuration, carries the control, so keep it to one rule that people remember.

How should you handle paper, printing and whiteboards?

Give sensitive paper somewhere to go: lockable pedestals or cabinets, a cross-cut shredder or locked disposal console, and a norm that desks are cleared of client material when vacated. Where print volume justifies it, PIN or badge release means nothing sits in the tray. Whiteboards are wiped after every session.

Four habits undermine otherwise decent provision:

• Keys left in cabinets, which turns lockable storage into open storage. Keys go home with the person or into a controlled place.
• Passwords or MFA backup codes on notes stuck to the monitor, when a password manager is the proper home.
• Print trays that fill, because collection relies on memory and no release control was ever bought.
• Glass-walled meeting rooms where whiteboards carry client detail for days after the session.

Print release is not the only answer. At genuinely low volume, "collect immediately" with the printer sited near the desks is proportionate. Record that reasoning in the risk assessment so the auditor sees a decision rather than an oversight.

Finished paper is where quiet leaks happen, and an open recycling bin is not disposal. Shred on the day or drop it in the locked console rather than stacking it for later. Courier deliveries and post that land on a reception desk belong in the same routine.

Meeting rooms work best with a named owner for the end-of-session sweep: the last person out wipes the board and clears the papers, with a cloth and a short reminder by the door.

The effort is modest. Pedestals, a shredder and the print arrangements amount to about a week of small purchases and communications. After that, "cleared of client material at end of day" is a norm you state, not a burden you police.

Does clear desk and clear screen apply to remote and hybrid workers?

Yes. The 2022 wording concerns wherever the information is, so kitchen tables, co-working spaces and trains are in scope. The MDM timer already locks the laptop at home, so the extra work is a written home-working expectation for paper and unattended devices, covered in awareness training so it reaches people who are not in the office.

The NCSC end user device security guidance gives the practical rule: do not leave a device unattended in an insecure location, such as outside your house or office. Lock it away if possible, or keep it on your person. It also asks users to stay aware of who can see their screen and to consider a privacy protector.

On trains and in co-working spaces, strangers sit within reading distance of an unlocked, in-use screen. A privacy filter is sensible standard issue for staff who regularly work in transit, and the ICO toolkit recommends privacy screens for the same reason.

A home-working section of the policy needs four plain statements:

• Lock the screen whenever you step away, at home as well as in the office.
• Keep client paper apart from household post and recycling.
• Shred client paper or return it to the office; never bin it.
• Never leave devices or papers unattended in cars or public places.

A policy section, an onboarding module and a periodic reminder give you three pieces of evidence that the expectation reached home workers. The mistake to avoid is pristine office discipline with no rule for the kitchen table.

What do auditors check for A.7.7 and how is it graded?

Auditors sample the live environment constantly: unlocked screens and abandoned documents on the way to interviews, the printer tray, whiteboards, and the MDM configuration compared against a device or two. No enforced lock policy across the estate grades major; an isolated unlocked screen grades minor or an opportunity for improvement.

Expect these questions in the room:

• "What's your screen-lock timeout, and show me the policy that pushes it. Can users turn it off?"
• "Walk me to the printer: what's in the tray right now?"
• "Where does sensitive paper live overnight, and where does it go to die?"
• "How do these rules apply to your people working from home?"
• "How do you check any of this actually happens?"

Staff are part of the sample. An auditor may ask someone at a desk what they do when they step away, and will read the exemption list closely, because admin and developer exemptions are the classic hole. Walk-round logs, where you claim them, are checked for regularity.

Each question has an artefact that answers it:

• Timeout and the off switch: the MDM or Group Policy profile and the fleet compliance report.
• The tray: secure-print settings, or the risk-assessment note justifying a low-volume alternative.
• Overnight and disposal: the lockable storage itself and the shredding arrangements.
• Home workers: the policy section, onboarding module and periodic reminder.
• Checking it happens: walk-round records with findings and follow-ups.

Grading follows certification-body practice rather than the standard itself. In a firm handling regulated data, a lock policy with broad exemptions and no compensating control counts the same as no policy: it is the absence-of-a-requirement case, and it grades major.

Patterns aggregate. Repeated walk-round findings with no follow-through read as an improvement loop that is not operating, and auditors treat sloppy desk-and-screen hygiene as a leading indicator that awareness training isn't landing.

A spotless walk-round log is less convincing than one that records real findings and the follow-up.

Arrive with the lock profile, the exemption register and a few months of walk-round records, and the walkthrough becomes a conversation rather than an interrogation. If the control is running, all three already exist, so preparing means exporting them, not creating them.

How do you automate A.7.7 evidence without policing your staff?

Treat the lock policy as code in an MDM or Group Policy baseline, so platform compliance reporting becomes continuous evidence and drift raises a ticket. Exemptions carry an expiry date, secure-print logs trend uncollected jobs, and the monthly walk-round becomes a scheduled ticket with a short checklist and photos.

Most of this is configuration you already own, which makes A.7.7 one of the most automatable physical controls: its core moved into software. The evidence builds up between audits instead of being gathered the week before, and the register an auditor reads maintains itself.

Uncollected print jobs become a hygiene metric you can trend, and walk-round findings become tracked actions with owners rather than notes in a notebook.

The failure mode is over-engineering: turning a hygiene habit into surveillance theatre, with naming-and-shaming and daily checks.

Daily desk inspections are what a firm resorts to when it hasn't enforced the timer.

An enforced timer, decent storage and a light monthly pass deliver the whole control. Our GRC engineering service builds exactly this pattern: lock policy as managed configuration, drift alerts, expiring exemptions and ticketed walk-rounds.

Four methods carry the engineered version of the control. Each leaves its own evidence.

Frequently asked questions