Clean desk policy

A clean desk policy sets out how people must leave their workspace when they are away from it. Sensitive documents and removable media are locked away, screens are locked, printouts are collected promptly from shared printers and whiteboards are wiped. ISO/IEC 27002 pairs it with its screen counterpart as a clear desk and clear screen control. The aim is to stop casual disclosure to cleaners, visitors and colleagues without a need to know.

The policy is one of the handling requirements that flow from classification: the more sensitive the material, the stricter the rule for storing it when unattended. It protects material on paper or an open screen, the human side of data in use, where technical controls give only partial protection. It is an administrative control that depends on awareness and spot checks, and it works alongside physical controls such as locked cabinets and secure shredding bins, and technical ones such as removable media controls.

Exam relevance: a scenario is likely to describe sensitive material left visible on a desk, an unlocked workstation or documents waiting on a printer, and ask which control addresses it. Candidates are expected to recognise a clean desk policy as the administrative answer, and to connect it with classification and the marking and labelling of the material involved.