Scribd
Upload
659 views2 pages

Clean Desk Policy Cyber Security Policy

This document outlines a clean desk policy for an organization. The policy aims to ensure that sensitive information is secured when employees are away from their desks. It requires that employees lock away or remove all hard copies and electronic files containing sensitive data when leaving their workstations unattended. It also mandates that computers be locked or shut down when not in use, passwords not be visible, and printers be cleared immediately. Compliance will be measured by periodic checks, and violations may result in disciplinary action.

Uploaded by

elly
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
659 views2 pages

Clean Desk Policy Cyber Security Policy

This document outlines a clean desk policy for an organization. The policy aims to ensure that sensitive information is secured when employees are away from their desks. It requires that employees lock away or remove all hard copies and electronic files containing sensitive data when leaving their workstations unattended. It also mandates that computers be locked or shut down when not in use, passwords not be visible, and printers be cleared immediately. Compliance will be measured by periodic checks, and violations may result in disciplinary action.

Uploaded by

elly
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 2

Clean Desk Policy

Overview

A clean desk policy can be an import tool to ensure that all sensitive/confidential materials are
removed from an end user workspace and locked away when the items are not in use or an
employee leaves his/her workstation. It is one of the top strategies to utilize when trying to
reduce the risk of security breaches in the workplace. Such a policy can also increase
employee’s awareness about protecting sensitive information.

1. Purpose
The purpose for this policy is to establish the minimum requirements for maintaining a “clean
desk” – where sensitive/critical information about our employees, our intellectual property, our
customers and our vendors is secure in locked areas and out of site. A Clean Desk policy is not
only ISO 27001/17799 compliant, but it is also part of standard basic privacy controls.

2. Scope
This policy applies to all <Company Name> employees and affiliates.

3. Policy
4.1 Employees are required to ensure that all sensitive/confidential information in hardcopy
or electronic form is secure in their work area at the end of the day and when they are
expected to be gone for an extended period.

4.2 Computer workstations must be locked when workspace is unoccupied.

4.3 Computer workstations must be shut completely down at the end of the work day.

4.4 Any Restricted or Sensitive information must be removed from the desk and locked in a
drawer when the desk is unoccupied and at the end of the work day.

4.5 File cabinets containing Restricted or Sensitive information must be kept closed and
locked when not in use or when not attended.

4.6 Keys used for access to Restricted or Sensitive information must not be left at an
unattended desk.

4.7 Laptops must be either locked with a locking cable or locked away in a drawer.

4.8 Passwords may not be left on sticky notes posted on or under a computer, nor may they
be left written down in an accessible location.

1
4.9 Printouts containing Restricted or Sensitive information should be immediately
removed from the printer.

4.10Upon disposal Restricted and/or Sensitive documents should be shredded in the official
shredder bins or placed in the lock confidential disposal bins.

4.11Whiteboards containing Restricted and/or Sensitive information should be erased.

4.12Lock away portable computing devices such as laptops and tablets.

4.13Treat mass storage devices such as CDROM, DVD or USB drives as sensitive and
secure them in a locked drawer

All printers and fax machines should be cleared of papers as soon as they are printed; this helps
ensure that sensitive documents are not left in printer trays for the wrong person to pick up.

4. Policy Compliance
5.1 Compliance Measurement
The Infosec team will verify compliance to this policy through various methods, including but
not limited to, periodic walk-thrus, video monitoring, business tool reports, internal and external
audits, and feedback to the policy owner.

5.2 Exceptions
Any exception to the policy must be approved by the Infosec team in advance.

5.3 Non-Compliance
An employee found to have violated this policy may be subject to disciplinary action, up to and
including termination of employment.

You might also like