ISO 27002:2022, Control 7.7 – Clear Desk and Clear Screen

Ownership of Control 7.7

Considering that Control 7.7 requires organisations to adopt and implement an organisation-wide clear desk and clear screen policy, information security officers should be responsible for production, maintenance and enforcement of clear desk and clear screen rules that apply across the entire organisation.

General Guidance on Compliance

Control 7.7 highlights that organisations should create and enforce a topic-specific policy that sets out clear desk and clear screen rules.

Furthermore, Control 7.7 lists seven specific requirements that organisations should take into account when establishing and enforcing clear desk and clear screen rules:

1. Sensitive or critical information assets stored on digital or physical items should be locked securely when they are not in use or when the workstation hosting those materials is vacated. For example, items such as paper records, computers, and printers should be stored in secure furniture such as a locked or password-protected cabinet or drawer.
2. Devices used by employees such as computers, scanners, printers, and notebooks should be protected via security mechanisms such as key locks when they are not used or when they are left unattended.
3. When employees vacate their workspace and leave their devices unattended, they should leave their devices logged off and the reactivation of the device should be only via a user authentication mechanism. Furthermore, automatic time-out and log-out features should be installed on all end-point employee devices such as computers.
4. Printers should be designed in a way that print-outs are collected immediately by the person(originator) who printed the document. Furthermore, a strong authentication mechanism should be in place so that only the originator is allowed to collect the printout.
5. Physical materials and removable storage media containing sensitive information should be kept secure at all times. When they are no longer needed, they should be disposed of through a secure mechanism.
6. Organisations should create rules for the display of pop-ups on screens and these rules should be communicated to all relevant employees. For example, e-mail and messaging pop-ups can contain sensitive information and if they are displayed on the screen during a presentation or in a public space, this may compromise the confidentiality of sensitive information.
7. Sensitive or critical information displayed on whiteboards should be erased when they are no longer needed.

Supplementary Guidance – Control 7.7

Control 7.7 cautions organisations against risks arising out of vacated facilities. When an organisation vacates a facility, physical and digital materials previously stored in that facility should be securely removed so that sensitive information is not left insecure.

Therefore, control 7.7 requires organisations to establish procedures for the vacation of facilities so that all sensitive information assets housed in that facility are securely disposed of. These procedures may include carrying out a final sweep so that no sensitive information is left unprotected.

Changes and Differences From ISO 27002:2013

27002:2022/7.7 replaces 27002:2013/(11.2.9)

There are two significant differences between the 2022 and the 2013 versions.

• 2022 version does not refer to criteria to consider when establishing and implementing clear desk and clear screen rules.

In contrast to the 2022 version, the 2013 version explicitly stated that organisations should consider organisation-wide information classification levels, legal & contractual requirements, and the types of risks facing the organisation when establishing a clear desk and clear screen policy.

The ISO 27002:2022 version, however, does not refer to these elements.

• 2022 version introduces new and more comprehensive requirements for the clear desk and clear screen rules.

In contrast to the 2013 version, the 2022 version sets out the following requirements that organisations should consider when establishing clear desk and clear screen rules.

• Organisations should create specific rules on pop-up screens to maintain the confidentiality of sensitive information.
• Sensitive information written on whiteboards should be removed when they are no longer needed.
• Employee endpoint devices such as computers should be protected with key locks when they are not used or when they are left unsupervised.

How ISMS.online Helps

ISO 27002 implementation is simpler with our step-by-step checklist that guides you through the whole process. Your complete compliance solution for ISO/IEC 27002:2022.

• Up to 81% progress from when you log in
• Simple and total compliance solution

Get in touch today to book a demo.