ISO 27001 A.7.7: clear desk and screen, explained for startups

A.7.7 Clear desk and clear screen

Screens lock and sensitive papers are put away when no one is at the desk. What proves it: an enforced automatic screen lock on every device, and a clear desk rule staff know.

A certification auditor samples screen lock settings and the clear desk rule. A file that usually does the job: device management settings enforcing a screen lock of 15 minutes or less, and the rule in your acceptable use policy.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.7.7 walks you through it in this order.

1. Enforce a screen lock of 5 to 15 minutes through device management.
2. Add a clear desk and clear screen rule to the acceptable use policy.
3. Check that the setting covers every device.

The free ISO 27001 readiness assessment asks 2 questions that evidence it:

• Do you enforce a clear desk and clear screen practice?
• Are laptops managed by a mobile device management (MDM) tool that enforces disk encryption, screen lock, updates, malware protection and remote wipe?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Physical and Environmental Security Policy covers A.7.7. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criteria that cover this ground: CC6.1, logical access and CC6.4, physical access.

Physical controls

A.7.7 is one of the 14 physical controls in Annex A. Buildings, rooms, equipment and media. A remote company with no office can exclude several of these in its Statement of Applicability, with the reason written down, and covers the rest through laptop rules and its cloud provider.

Nearby controls in the same theme:

• A.7.4, physical monitoring
• A.7.5, environmental threats
• A.7.6, working in secure areas
• A.7.8, placing equipment safely
• A.7.9, devices off site
• A.7.10, storage media

Before it: A.7.6, working in secure areas. After it: A.7.8, placing equipment safely. Every control, by theme, is on the Annex A controls page.