--- title: "ISO 27001 Annex A 7.7: clear desk and clear screen without policing" canonical: https://www.grcmana.io/vault/iso-27001/annex-a-7-7-clear-desk-and-clear-screen published: 2023-05-17 updated: 2026-10-07 author: "Harry West" framework: "ISO 27001" control: "A.7.7 Clear desk and clear screen" journeyStage: implementation --- # ISO 27001 Annex A 7.7: clear desk and clear screen without policing ## Key takeaways Annex A 7.7 is a preventive confidentiality control with a screen half and a desk half. Enforce the screen lock centrally through MDM or Group Policy, give paper and print a proportionate home, and extend the rules to home workers. A light monthly walk-round and an exemption register with expiry dates give auditors the evidence they sample. - **Control nature** — A preventive, confidentiality-only control with two halves: physical workspace hygiene for desks, paper and whiteboards, and endpoint screen locking enforced centrally through device management. - **Screen lock** — Push an inactivity lock of a few minutes through MDM or Group Policy, require normal authentication to unlock, and stop users from switching it off. - **Audit grading** — Auditors sample screens, printer trays, whiteboards and MDM configuration. No enforced lock policy across the estate grades major; an isolated unlocked screen grades minor or an improvement opportunity. - **Ongoing effort** — Policy-driven lock enforcement is quick, paper and print arrangements are small purchases, and a light monthly walk-round is the only ongoing cost across the whole control. The auditor is walking to the first interview. On the way past the open-plan desks, a laptop sits unlocked and a printout waits in the printer tray. That is a finding before a single question has been asked. This guide shows how to meet ISO 27001 Annex A 7.7 without turning the office into a patrol: an enforced screen lock, a few small purchases for paper and print, and a ten-minute monthly walk-round. It is written for security managers and IT leads at regulated firms of 25 to 250 staff, with engineers who want exemptions and half the team working from home. ## What does ISO 27001 Annex A 7.7 require? ISO 27001 Annex A 7.7 requires written, communicated and genuinely enforced rules that keep sensitive information from sitting exposed on desks, screens and shared surfaces such as printers and whiteboards. The rules live in a topic-specific policy under Annex A 5.1, and a section within your security policy satisfies that at this scale. The control has two halves. The desk half covers paper, media, printers and whiteboards. The screen half is endpoint security, and at most modern firms that is where the bulk of the control lives, enforced through the same device estate you manage under Annex A 8.1. Inside secure areas such as a server room, Annex A 7.6 picks up the same discipline. For everywhere else, the [ICO physical security toolkit guidance](https://ico.org.uk/for-organisations/advice-and-services/audits/data-protection-audit-framework/toolkits/information-and-cyber-security/physical-security/) sets the practical baseline: document clear desk and clear screen requirements, communicate them to all staff and set screens to lock automatically after an appropriate period. It also recommends regular physical checks that staff follow the rules, which is the job of the walk-round described below. That section should cover: - paper and media storage - screen locking - printing - whiteboards and meeting rooms - notification suppression when presenting - the remote-work expectation Approve and communicate it like any other topic policy, and ask new starters to acknowledge it during onboarding so the communication trail exists. What matters to an auditor is that the section matches what people actually do. The control is preventive and concerns confidentiality only: an observed screen discloses information, it does not corrupt it. The stakes are still visible. Prospects touring the office, an enterprise customer's due-diligence team and the certification auditor all notice an unlocked screen, and they read it as your real security culture whatever the policy pack says. For a regulated firm, one HR letter or one glimpse of a client dashboard becomes a reportable-event conversation. ## How do you enforce the screen lock centrally rather than relying on people? Push an inactivity lock to every device through your MDM platform or Group Policy, with a timeout of a few minutes and normal authentication to unlock. The timer is the control; locking on walk-away is a bonus habit. Users should not be able to switch it off, and any exception must be recorded and time-boxed. This is an hour's work, because the lock rides on the baseline that already configures your endpoints. The sequence is short: 1. **Choose the timeout.** A few minutes of inactivity is the widely accepted band: short enough to close the walk-away window and long enough not to fight your users. 2. **Push it to every managed device.** Laptops, desktops and, where you manage them, phones all take the same profile. 3. **Remove the off switch.** Users cannot change or disable the timer from their settings. 4. **Require normal authentication to unlock.** No special bypass, no shared PIN. 5. **Teach the lock shortcut.** Make locking on walk-away the cultural default, knowing the timer backs it up. Then the engineers arrive. Developers and administrators ask to be exempted because the lock interrupts long builds and debugging sessions. They are also the accounts with the most access, which makes them the first place an auditor looks. An exemption list with no expiry dates is a register of standing holes in your highest-privilege accounts. A real need gets a ticketed, time-boxed exception instead: a named approver, a short expiry and a compensating control, such as the device sitting in a locked room. When the date passes, the exception lapses or is re-approved on purpose. At this scale, one baseline and one exceptions register show auditors and enterprise customers that the control is enforced rather than hoped for. ## How do you stop screen shares and meeting rooms leaking client data? Presenters should share a single application window rather than the whole desktop, and switch on do-not-disturb before any screen share or meeting-room display. That suppresses the pop-up notifications that expose client names and messages. One line in the policy and one demonstration during onboarding make it the default behaviour. A notification preview shows a sender's name and the first line of a message. Shared to a customer call or a wall display, it hands that detail to everyone watching, and the presenter often never sees it. Window sharing also keeps open mail and chat out of view. Meeting rooms need the habit as much as customer calls do. A laptop plugged into a big-room display shows its banners to every visitor in the room, and to anyone walking past a glass wall. The onboarding demonstration works best on the new starter's own laptop: switch on do-not-disturb, share one window, and show what the audience would have seen without either. It sticks better than a paragraph in a handbook. Where a presenter regularly demonstrates from live client systems, prepare a demo workspace in advance so nothing sensitive is open in the first place. This is one of the few spots where behaviour, not configuration, carries the control, so keep it to one rule that people remember. ## How should you handle paper, printing and whiteboards? Give sensitive paper somewhere to go: lockable pedestals or cabinets, a cross-cut shredder or locked disposal console, and a norm that desks are cleared of client material when vacated. Where print volume justifies it, PIN or badge release means nothing sits in the tray. Whiteboards are wiped after every session. Four habits undermine otherwise decent provision: - **Keys left in cabinets**, which turns lockable storage into open storage. Keys go home with the person or into a controlled place. - **Passwords or MFA backup codes on notes** stuck to the monitor, when a password manager is the proper home. - **Print trays that fill**, because collection relies on memory and no release control was ever bought. - **Glass-walled meeting rooms** where whiteboards carry client detail for days after the session. Print release is not the only answer. At genuinely low volume, "collect immediately" with the printer sited near the desks is proportionate. Record that reasoning in the risk assessment so the auditor sees a decision rather than an oversight. Finished paper is where quiet leaks happen, and an open recycling bin is not disposal. Shred on the day or drop it in the locked console rather than stacking it for later. Courier deliveries and post that land on a reception desk belong in the same routine. Meeting rooms work best with a named owner for the end-of-session sweep: the last person out wipes the board and clears the papers, with a cloth and a short reminder by the door. The effort is modest. Pedestals, a shredder and the print arrangements amount to about a week of small purchases and communications. After that, "cleared of client material at end of day" is a norm you state, not a burden you police. ## Does clear desk and clear screen apply to remote and hybrid workers? Yes. The 2022 wording concerns wherever the information is, so kitchen tables, co-working spaces and trains are in scope. The MDM timer already locks the laptop at home, so the extra work is a written home-working expectation for paper and unattended devices, covered in awareness training so it reaches people who are not in the office. The [NCSC end user device security guidance](https://www.ncsc.gov.uk/guidance/end-user-devices-advice-end-users) gives the practical rule: do not leave a device unattended in an insecure location, such as outside your house or office. Lock it away if possible, or keep it on your person. It also asks users to stay aware of who can see their screen and to consider a privacy protector. On trains and in co-working spaces, strangers sit within reading distance of an unlocked, in-use screen. A privacy filter is sensible standard issue for staff who regularly work in transit, and the ICO toolkit recommends privacy screens for the same reason. A home-working section of the policy needs four plain statements: - Lock the screen whenever you step away, at home as well as in the office. - Keep client paper apart from household post and recycling. - Shred client paper or return it to the office; never bin it. - Never leave devices or papers unattended in cars or public places. A policy section, an onboarding module and a periodic reminder give you three pieces of evidence that the expectation reached home workers. The mistake to avoid is pristine office discipline with no rule for the kitchen table. ## What do auditors check for A.7.7 and how is it graded? Auditors sample the live environment constantly: unlocked screens and abandoned documents on the way to interviews, the printer tray, whiteboards, and the MDM configuration compared against a device or two. No enforced lock policy across the estate grades major; an isolated unlocked screen grades minor or an opportunity for improvement. Expect these questions in the room: - "What's your screen-lock timeout, and show me the policy that pushes it. Can users turn it off?" - "Walk me to the printer: what's in the tray right now?" - "Where does sensitive paper live overnight, and where does it go to die?" - "How do these rules apply to your people working from home?" - "How do you check any of this actually happens?" Staff are part of the sample. An auditor may ask someone at a desk what they do when they step away, and will read the exemption list closely, because admin and developer exemptions are the classic hole. Walk-round logs, where you claim them, are checked for regularity. Each question has an artefact that answers it: - **Timeout and the off switch:** the MDM or Group Policy profile and the fleet compliance report. - **The tray:** secure-print settings, or the risk-assessment note justifying a low-volume alternative. - **Overnight and disposal:** the lockable storage itself and the shredding arrangements. - **Home workers:** the policy section, onboarding module and periodic reminder. - **Checking it happens:** walk-round records with findings and follow-ups. Grading follows certification-body practice rather than the standard itself. In a firm handling regulated data, a lock policy with broad exemptions and no compensating control counts the same as no policy: it is the absence-of-a-requirement case, and it grades major. Patterns aggregate. Repeated walk-round findings with no follow-through read as an improvement loop that is not operating, and auditors treat sloppy desk-and-screen hygiene as a leading indicator that awareness training isn't landing. A spotless walk-round log is less convincing than one that records real findings and the follow-up. Arrive with the lock profile, the exemption register and a few months of walk-round records, and the walkthrough becomes a conversation rather than an interrogation. If the control is running, all three already exist, so preparing means exporting them, not creating them. ## How do you automate A.7.7 evidence without policing your staff? Treat the lock policy as code in an MDM or Group Policy baseline, so platform compliance reporting becomes continuous evidence and drift raises a ticket. Exemptions carry an expiry date, secure-print logs trend uncollected jobs, and the monthly walk-round becomes a scheduled ticket with a short checklist and photos. Most of this is configuration you already own, which makes A.7.7 one of the most automatable physical controls: its core moved into software. The evidence builds up between audits instead of being gathered the week before, and the register an auditor reads maintains itself. Uncollected print jobs become a hygiene metric you can trend, and walk-round findings become tracked actions with owners rather than notes in a notebook. The failure mode is over-engineering: turning a hygiene habit into surveillance theatre, with naming-and-shaming and daily checks. Daily desk inspections are what a firm resorts to when it hasn't enforced the timer. An enforced timer, decent storage and a light monthly pass deliver the whole control. Our GRC engineering service builds exactly this pattern: lock policy as managed configuration, drift alerts, expiring exemptions and ticketed walk-rounds. Four methods carry the engineered version of the control. Each leaves its own evidence. | Method | What it catches | Cadence | Evidence produced | | --- | --- | --- | --- | | Lock policy in an MDM or Group Policy baseline | Devices drifting from the timeout, users disabling the lock | Continuous | Platform compliance report, drift tickets | | Exemptions with expiry dates | Standing waivers for engineers and administrators | At each expiry date | Exemption register with approver and dates | | Secure-print telemetry | Uncollected jobs, trays filling | Reviewed on a regular trend | Released versus expired job logs | | Monthly walk-round ticket | Loose paper, unwiped boards, unlocked screens, keys left in cabinets | Monthly | Checklist, photos, tracked actions | ## Frequently asked questions ### What did the 2022 revision add to Annex A 7.7? The 2022 wording added the modern leak paths: suppressing pop-up notifications during presentations and screen shares, wiping display surfaces such as whiteboards, physically securing unattended devices, and sweeping premises when you vacate them. If your policy was written against the 2013 text, check that each of those four appears in it and in your onboarding material. ### Is Annex A 7.7 still applicable if we are fully paperless? Mostly the desk half falls away, and your Statement of Applicability (the register of applicable controls) can say so. Write the justification so it names the residual items rather than just the word "paperless": the office printer, courier deliveries, notebooks and whiteboards usually keep a small paper story alive. The screen half still applies in full. ### What screen lock timeout is acceptable for A.7.7? A few minutes of inactivity is the widely accepted band. Record the reasoning beside the value: an open-plan office that receives visitors justifies the short end. Remember what the timer cannot do. It protects a screen nobody is using, not one being read over its owner's shoulder, which is where privacy filters and the presenting rule come in. ### Should A.7.7 walk-round logs show zero findings? No. A log that occasionally records a loose printout or an unwiped board, with the fix and its date, reads as a control that is working. Each entry needs only the date, the area covered, the finding, who fixed it and when. Feed findings back to the team as a general reminder rather than naming individuals, so the log shows the loop closing without becoming a patrol. ### Does A.7.7 apply when we vacate an office or desk space? Yes. When you leave a desk, floor or office permanently, sweep for stray documents before handing back the keys. Check pedestals, drawers, meeting-room boards, the printer tray and any disposal bins, and keep a short record of the sweep. That record doubles as evidence that the rules apply to premises as well as people.