Clean Desk and Clear Screen Policy Template: Ready Rules for Desks, Screens and Print

Papers left on a desk overnight, an unlocked laptop in a meeting room and a payroll report sitting in a printer tray are among the cheapest ways for information to leave an organisation. This template gives you a ready clean desk and clear screen policy: what must be cleared and when, screen lock timers and how to enforce them with device management, printing and whiteboards, shared and hot desks, home and travel working, and how to check compliance without turning it into a policing exercise. It is written for CISOs, information security managers and facilities leads who need a standalone policy that lines up with ISO/IEC 27002:2022 control 7.7 (clear desk and clear screen). Broader building controls such as zones, badges and visitors sit in the Physical and Environmental Security Policy Template; this page goes deeper on the desk and the screen.

How to use this template

• Replace text in square brackets, such as [Organisation], [Information Security Manager] and [5 minutes], with your own terms and values. Bracketed values are suggested defaults set by NHI Mgmt Group, not external requirements, except where a standard is named next to them.
• "Must" indicates a mandatory requirement. "Should" indicates a recommended practice where a documented exception may be justified.
• Link section 4.1 to your existing information classification scheme. If you do not have one, start with the Data Classification Policy Template; the rules here scale by classification.
• Set the technical screen lock values in section 4.4 together with your endpoint team so the policy matches what device management actually enforces. A policy timer that differs from the configured timer is a common audit finding.
• Have HR and, where relevant, works councils or employee representatives review section 6 (compliance checks) before adoption, as desk sweeps involve looking at personal workspaces.

1. Purpose

This policy reduces the risk of unauthorised access to, loss of, or damage to [Organisation]'s information during and outside normal working hours. It sets requirements for clearing paper documents, removable media and portable devices from workspaces, for locking screens when they are unattended, for preventing information being overlooked on screen, and for handling printed output, whiteboards and waste. Its aim is that information is visible only to people with a need to see it, wherever they work.

2. Scope

This policy applies to:

• All employees, contractors, temporary staff, interns and third parties who handle [Organisation] information.
• All workspaces where [Organisation] information is handled: offices, shared and hot desks, meeting rooms, reception and post rooms, home offices, client sites, co-working spaces, and public places during travel.
• Information in any form: paper, notebooks, sticky notes, whiteboards and flipcharts, printed and faxed output, removable media (USB drives, external disks, memory cards), and screens on laptops, desktops, tablets, phones, thin clients and wall displays.
• All devices that display [Organisation] information, whether issued by [Organisation] or personally owned under the BYOD Policy Template rules.

3. Roles and responsibilities

4. Policy statements

4.1 What must be cleared, by classification

1. "Briefly unattended" means any time the user leaves the workspace, including for a coffee or a short meeting. "Extended absence" means [more than 1 hour], lunch breaks in open areas, and the end of the working day.
2. Removable media and portable devices (laptops, tablets, phones, hardware tokens) must be locked away or taken with the user at the end of the day. Laptops left on site overnight must be in a locked drawer, locker or [secured cable lock in a restricted area].
3. Keys to drawers and cabinets must not be left in locks or on desks. Spare keys are held by [Head of Facilities] in a key register.

4.2 Credentials and secrets

1. Passwords, PINs, recovery codes, Wi-Fi keys and similar secrets must never be written on sticky notes, notebooks, whiteboards or desk surfaces, or stuck to devices or monitors.
2. Hardware security keys and smart cards must be removed from the device and kept with the user when the device is unattended. Where smart card login is used, removing the card should lock the session (see section 4.4).
3. Printed break-glass credentials or recovery material must be stored only as set out in [the privileged access policy], in a sealed envelope in a safe with logged access.

4.3 Clear screen behaviour

1. Users must lock their screen every time they leave a device unattended, however briefly (for example Windows key + L on Windows, Control + Command + Q on macOS).
2. Screens must be positioned so that information is not visible from windows, doorways, reception areas or public corridors. Where this is not possible, a privacy filter must be fitted to devices that display [Confidential] or [Restricted] information.
3. In public places and when travelling, users must not view [Confidential] or [Restricted] information where it can be overlooked, and must use a privacy filter for any other work.
4. Before sharing a screen in a meeting or video call, users must close or minimise unrelated documents, email and chat, and should share a single application window rather than the whole desktop.
5. Notifications that show message content must be hidden on the lock screen of all devices that receive [Organisation] email or chat.
6. Wall displays, dashboards and kiosk screens in shared areas must show only information classified [Internal] or below, and must not display personal data unless [the Data Protection Officer] has approved it.

4.4 Technical enforcement of screen lock

User behaviour is backed by technical settings so that a forgotten lock still happens. CIS Controls v8.1 Safeguard 4.3 sets automatic session locking after no more than 15 minutes of inactivity on general purpose operating systems and 2 minutes on mobile end-user devices; [Organisation] sets shorter defaults below.

1. Users must not be able to disable or lengthen the configured timer. Users may choose a shorter timer.
2. Locked screens must hide previously displayed content and show only a neutral image or lock screen message.
3. Where smart cards or security keys are used for login, card or key removal should lock the session.
4. Application and remote sessions (virtual desktops, remote desktop, web applications holding [Confidential] data) must also time out under [the remote access policy]. See the Remote Access Policy Template.

4.5 Printing, copying and scanning

1. Printers and multifunction devices in shared areas must use pull printing (secure release by badge or PIN) for all users. Jobs not released within [24 hours] must be deleted automatically.
2. Users must collect printed and copied output immediately. Output found unclaimed must be placed in confidential waste, or handed to [the IT service desk] if it is [Restricted].
3. Originals must not be left on scanner or copier glass. Scan-to-email must send only to the authenticated user's own address unless [the IT service desk] has approved a shared mailbox.
4. Printing of [Restricted] information must be minimised and, where needed, sent only to printers in [restricted areas].

4.6 Meeting rooms, whiteboards and shared spaces

1. At the end of every meeting, the organiser must wipe whiteboards, remove flipchart pages, collect papers, and log out of room systems and video conferencing accounts.
2. Photographs of whiteboards containing [Confidential] information must be stored only in [approved repositories] and deleted from personal camera rolls.
3. Hot desks must be left completely clear at the end of each use. [Head of Facilities] must provide a lockable locker for each regular hot desk user.
4. Items found on hot desks or in meeting rooms after [the end of the day] are removed by [facilities], logged, and held securely for [5 working days] before disposal as confidential waste.

4.7 Disposal of paper and media

1. Documents classified [Internal] or above must be disposed of in locked confidential waste bins or shredded with a cross-cut shredder. Ordinary recycling bins must not be used for them.
2. Confidential waste must be collected by [an approved contractor] under contract, with certificates of destruction kept for [2 years].
3. Removable media, notebooks containing [Confidential] information and failed hardware must be returned to [the IT service desk] for sanitisation or destruction. See the Media Sanitisation Guide.

4.8 Home, hybrid and travel working

1. The rules in sections 4.1 to 4.7 apply in home offices. Users must store [Confidential] papers and devices out of sight of household members and visitors when not in use, and must lock screens when stepping away.
2. [Confidential] papers must not be disposed of in household waste. Users must return them to the office for confidential disposal or use [an issued cross-cut shredder].
3. Devices and papers must not be left unattended in vehicles, hotel rooms (unless in a safe), or public places. Calls discussing [Confidential] matters must not be held where they can be overheard.
4. See the Home Office and Remote Worker Security Guide for wider home working controls.

4.9 Reporting

1. Anyone who finds [Confidential] or [Restricted] information or an unlocked device left unattended must secure it if safe to do so and report it to [the IT service desk or security mailbox].
2. Loss of documents or devices containing personal data must be reported at once under [the incident response procedure], as it may be a personal data breach with a notification deadline.

5. Exceptions

1. Where a role cannot meet a requirement (for example a control room display that must stay visible, or a shared clinical workstation where a short timer would harm patient care), the line manager must record the gap, the compensating controls and a review date in [the exception register].
2. Exceptions are approved by [Information Security Manager] and expire after no more than [12 months].

6. Compliance and monitoring

1. [Information Security Manager] must arrange unannounced clean desk sweeps of each office at least [quarterly], covering desks, printers, meeting rooms and waste bins, using a standard checklist. Results are reported by area, not by named individual, unless there is repeated non-compliance.
2. Sweepers leave a friendly reminder card where they find an issue, secure any [Confidential] or [Restricted] material, and record what they found.
3. The endpoint team must report [monthly] the percentage of managed devices compliant with the screen lock settings in section 4.4.
4. The following measures are reported to [the security steering group] [quarterly]:
   • Percentage of desks passing the clean desk sweep, by area.
   • Number of unlocked unattended devices found.
   • Number of [Confidential] or [Restricted] items found unsecured, and in printers.
   • Percentage of managed devices enforcing the configured screen lock timer.
   • Unreleased print jobs deleted (as a sign of pull printing use).
5. Repeated or deliberate breaches of this policy may be handled under [the disciplinary procedure].

7. Review and approval

This policy is reviewed at least [annually] and after any incident involving information left unattended, by [Information Security Manager]. Approved by [CISO] on [date]. Version [1.0].

Implementation guidance

Rolling it out

1. Provide storage first: before announcing the policy, check each area has lockable drawers or lockers, confidential waste bins and pull printing. A policy that asks people to lock away papers with nowhere to lock them fails on day one.
2. Enforce the screen lock technically: deploy the section 4.4 settings to a pilot group, check for issues with presentation and kiosk devices, then roll out to all managed devices and record exceptions.
3. Brief and train: add the policy to induction and your awareness programme with a short, practical message: lock, clear, collect. See the Security Awareness and Human Risk Management Guide.
4. Run a baseline sweep: do a first sweep with reminder cards only, so people learn what is checked before results are reported.
5. Report and repeat: share area results with managers, focus follow-up on areas with the most [Confidential] findings, and track the trend.

Scaling for organisation size

Common failure patterns this policy is written to prevent

• Policy without furniture: no lockers for hot desks, so papers stay out; section 3 makes facilities responsible for storage.
• Timer drift: the policy says 5 minutes, devices are set to 30 or not set at all; section 4.4 ties the policy to enforced settings and a monthly compliance report.
• Passwords on sticky notes: the single most common sweep finding in many offices; section 4.2 bans it and the sweep checks for it.
• Printer trays as storage: sensitive reports printed and never collected; section 4.5 uses pull printing and auto-deletion.
• Screen sharing leaks: a whole desktop with email and chat shared to a customer call; section 4.3 asks for single-window sharing.
• Sweeps as surveillance: naming individuals publicly breeds resentment and hiding; section 6 reports by area first.

Framework mapping

Sources

• ISO: ISO/IEC 27002:2022 Information security controls
• NIST: SP 800-53 Rev. 5, Security and Privacy Controls
• CIS: Critical Security Controls v8.1
• Microsoft Learn: Interactive logon: Machine inactivity limit
• Microsoft Learn: Policy CSP DeviceLock
• eCFR: 45 CFR 164.312 Technical safeguards
• ICO: A guide to data security
• PCI Security Standards Council: Document Library (PCI DSS)

Related NHI Mgmt Group resources: Physical and Environmental Security Policy Template · Acceptable Use Policy Template · ISO 27002 Controls Guide · Endpoint Hardening Checklist · Data Classification Policy Template