All 93 controls · Physical controls
Control 7.7
Clear desk and clear screen
What ISO/IEC 27002:2022 control 7.7 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Rules requiring clear desks for papers and removable media and clear screens for processing facilities are to be defined and suitably enforced. Purpose: lower the risk of unauthorized access to, loss of or damage to information left on desks, screens and other reachable places, in and outside working hours. Guidance: publish a topic-specific policy on clear desks and clear screens to relevant parties and consider: locking away sensitive or critical information on paper or media, preferably in a safe or lockable cabinet, when not needed and especially when the office is empty; securing user endpoint devices with key locks or similar when unused or unattended; logging off unattended devices or protecting them with an authenticated screen and keyboard lock, and configuring timeouts or automatic logout on all computers and systems; having people collect printouts immediately and using printers that release jobs only after the originator authenticates at the device; storing sensitive documents and media securely and disposing of them securely when no longer needed; setting rules for screen pop-ups, such as turning off email and messaging notifications during presentations, screen sharing or in public; and wiping sensitive information from whiteboards and other displays after use. When facilities are vacated, a final sweep should confirm nothing is left behind, such as documents that have fallen behind drawers or furniture.
Purpose in the standard’s terms, in our words: Reduces the risk of unauthorized access, loss or damage to information left on desks, screens and other accessible places.
Attribute values in one line: Preventive; Confidentiality; Protect; Physical security; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | Confidentiality |
| Cybersecurity concepts | Protect |
| Operational capabilities | Physical security |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- The topic-specific clear desk and clear screen policy and its communication
- Configuration evidence of screen lock and automatic logout timeouts on endpoints and systems
- Secure print or follow-me printing configuration requiring authentication at the device
- Clear desk walk-round or spot-check records with findings and follow-up
- Availability of lockable storage and secure disposal bins
- Records of final sweeps when offices or facilities are vacated
Where audits commonly find gaps
- Screen lock timeouts are long or can be disabled by users
- Sensitive printouts accumulate uncollected at shared printers
- Whiteboards in meeting rooms retain confidential content
- Notification pop-ups reveal confidential messages during screen sharing
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (11.2.9) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.