Clean Desk Policy
A1.0 cleanPurpose
This policy can be an import tool to ensure that all sensitive/confidential materials are removed from an end user workspace and locked away when the items are not in use or an employee leaves his/her workstation. It is one of the top strategies to utilize when trying to reduce the risk of security breaches in the workplace. Such a policy can also increase employee’s awareness about protecting sensitive information.
The purpose for this policy is to establishestablishes the minimum requirements for maintaining a “secure workspace environment, commonly referred to as a "clean desk”desk." –A whereclean sensitive/desk practice is a critical control for protecting sensitive and confidential information about(in ourboth employees, our intellectual property, our customersphysical and ourelectronic vendorsformats) isfrom secureunauthorized inaccess, lockeddisclosure, areasor loss. It helps reduce the risk of security breaches, increases awareness about information protection responsibilities, and outsupports ofcompliance site.with information Asecurity Cleanstandards Desk(such policy is not onlyas ISO 27001/1779927001) compliant, but it is also part of standard basicand privacy controls.regulations.
Thisgoal policy applies to all <Company Name> employees and affiliates.
Employees are requiredis to ensure that allsensitive sensitive/confidentialor critical information inpertaining hardcopyto orthe electronicorganization, formits employees, customers, vendors, and intellectual property is secureappropriately insecured theirwhen workunattended areaor at the end of the dayworkday.
2.0 Scope
This policy applies to all employees, contractors, consultants, temporary staff, and whenaffiliates theyof the organization working within organizational facilities or handling organizational information assets.
3.0 Policy Statements
All individuals subject to this policy are expectedrequired to beadhere goneto forthe anfollowing extendedclean period.desk practices:
3.1 Securing Workstations and Electronic Media
* **Lock Workstations:** Computer workstations must be locked when(e.g., using Ctrl+Alt+Del or Win+L) whenever the workspace is unoccupied.
even for short periods.
* **End-of-Day Shutdown:** Computer workstations mustshould typically be logged off or shut completely down at the end of the workworkday, day.unless specific instructions are provided by IT for maintenance purposes.
* **Secure Laptops and Portable Devices:** Laptops and other portable computing devices (e.g., tablets) must be physically secured using a locking cable or stored in a locked drawer or cabinet when unattended and at the end of the workday.
* **Secure Removable Media:** Mass storage devices (e.g., USB drives, external hard drives, CDs, DVDs) containing sensitive or confidential information must be treated as sensitive and secured appropriately, typically by storing them in a locked drawer or cabinet when not in use.
Any3.2 Securing Physical Documents and Materials
* **Clear Desks:** Sensitive or confidential documents (Restricted or Sensitive information as per the Data Classification Policy) must be removed from the desk surface and lockedsecured in a drawerlocked drawer, cabinet, or other approved secure container when the deskworkspace is unoccupied and always at the end of the workworkday.
* day.**Lock
File cabinets and drawers containing Restrictedsensitive or Sensitiveconfidential information must be kept closed and locked when not in direct use or when notunattended.
* attended.**Secure
Keys used forto access to Restrictedcabinets or Sensitivedrawers containing sensitive or confidential information must not be left unattended at a desk or in an unattendedunsecured desk.location.
*
LaptopsOutput:** Printouts and faxes, especially those containing sensitive or confidential information, should be retrieved immediately from printers, copiers, and fax machines to prevent unauthorized viewing or removal.
* **Secure Disposal:** Documents containing sensitive or confidential information must be eitherdisposed lockedof withproperly ausing lockingdesignated cablesecure ormethods, lockedsuch away in a drawer.
Passwords may not be left on sticky notes posted on or under a computer, nor may they be left written down in an accessible location.
Printouts containing Restricted or Sensitive information should be immediately removed from the printer.
Upon disposal Restricted and/or Sensitive documents should be shredded in theas official shredder bins or placed in the locklocked confidential disposal bins.
They should not be placed in regular trash receptacles.
* **Whiteboards:** Whiteboards containing Restrictedsensitive and/or Sensitiveconfidential information should be erased.erased when the information is no longer needed or when the workspace will be left unattended.
Lock3.3 awayPassword portableSecurity
* devicesPasswords must never be written down and left in an accessible location, such as laptopson andsticky tablets.notes attached to monitors, under keyboards, or in unlocked drawers. Refer to the Password Policy for secure password management practices.
Treat4.0 mass storage devices such as CDROM, DVD or USB drives as sensitive and secure them in a locked drawerCompliance
All4.1 printersCompliance and fax machines should be cleared of papers as soon as they are printed; this helps ensure that sensitive documents are not left in printer trays for the wrong person to pick up. Measurement
The
designatedComplianceauthority Measurement
The(e.g., Precision Computer teamteam, Facilities Security, Internal Audit) will verify compliance towith this policy through various methods, including but not limited to, periodic physical walk-thrus,throughs videoof monitoring,workspaces, businessawareness tool reports, internal and externalchecks, audits, and feedbackreview toof thesecurity policyincident owner. reports.
4.2 Exceptions
Any exception to thethis policy requires formal, documented justification based on business needs and must be approved in advance by the designated authority (e.g., Precision Computer team inor advance.relevant department manager). Compensating controls may be required.
An4.3 employeeEnforcement
Failure to haveadhere violatedto this policy may beresult subject toin disciplinary action, up to and including termination of employment.employment or contract, consistent with organizational procedures and the severity of the violation. Repeated non-compliance may lead to removal of access privileges.
Users should also be familiar with policies related to:
* Data Classification Policy
* Password Policy
* Information Handling Policy
* Workstation Security Policy