What A.7.7 clear desk and clear screen asks for in an ISO 27001 audit
A.7.7 asks the organization to define and enforce two rules: a clear desk rule for papers and removable storage media, and a clear screen rule for information processing facilities. An assessor will check that both rules exist in writing, that they match how people really work, and that they are enforced. The first half covers what people leave on desks, in printers, on whiteboards and in trays: confidential papers, notes, USB drives, backup tapes and similar media. The second half covers the screens of laptops, workstations and terminals that can be seen or reached when someone steps away. The risk is simple: information left visible or unattended can be read, photographed, copied or taken by visitors, contractors, cleaners or colleagues who have no need to see it. Most of the work is behavioral, so the rule on paper is the easy part. Auditors usually find the gap in enforcement, where the policy exists but desks show sticky notes with passwords, screens lock only after a long idle timeout, or printouts sit on a shared tray for hours.
Expect the assessor to test enforcement directly. A typical approach is a walk-through of a sample of desks, meeting rooms, printers and open-plan areas during working hours and after hours, followed by a review of the screen lock settings on a sample of endpoints. The assessor will also ask who performs periodic checks, what they record, and what happens when someone breaks the rule. Confirm with your own certification body how it plans to sample sites and devices, because that shapes how much evidence you need for each location. For endpoints, the automatic lock setting is the technical half of the control, and it is closely tied to A.8.1 User endpoint devices. For removable media, the rule overlaps with A.7.10 Storage media. Context on the wording: ISO/IEC 27002:2022 gives guidance on this control, and its correspondence table traces it to the 2013 edition's A.11.2.9 Clear desk and clear screen policy. Read the guidance and the control attributes in the standard itself, available from the ISO/IEC 27001:2022 publication page, before you draft the rule, and agree the wording with your auditor early.
Which desks, screens and devices are in scope for A.7.7
A.7.7 applies wherever information is handled on paper, screens or removable media, so the scope decision is really a map of every place those things exist. The cards below cover the areas and devices that most often change the work, and each one links back to how the organization records its choices in the Statement of Applicability and in the related controls A.8.1 and A.7.10.
Office floors and shared areas
Open-plan floors, hot desks, reception counters and shared kitchens are where papers, notebooks and unlocked screens are most often left unattended. The scope should name each floor or zone, the people who work there, and whether visitors or contractors can walk through without an escort. Check how many desks are assigned and how many are shared, because hot desking breaks any rule that assumes a person owns the desk. Confirm who checks these areas after hours, and whether the organization treats a cleaning contractor as a party with access to the desk surface.
Home offices and remote workstations
Remote staff keep information on desks that the organization does not control, often shared with family members or other households. The scope should state whether the clear desk rule applies at home, how the rule is communicated, and which devices and papers are covered. Ask whether printed client material is allowed at home at all, and where it must be stored when not in use. This area is closely tied to A.7.9 Security of assets off-premises, so the two scope entries should cross-reference each other.
Printers and shared output devices
Multifunction printers, scanners and copiers hold documents in queues and sometimes in internal storage. Scope these devices explicitly, including any that sit in a corridor or a shared room, and record who may collect printed pages. Ask whether jobs are held until a user authenticates at the device, and whether the organization can see print logs. Abandoned output is one of the most common findings in desk checks, so the scope should also say how stray pages are collected and destroyed.
Whiteboards and meeting rooms
Whiteboards, flip charts and wall displays often carry customer names, pricing or architecture diagrams, and they are rarely cleared after a meeting. Include every meeting room and common space that has these surfaces in the scope, along with any video conferencing screens that keep a session history. Confirm who owns the cleaning routine for each room and whether visitors can use the rooms unescorted. The scope should record a clear rule for erasing boards at the end of each meeting, because an auditor will look for it in the room itself.
Data center and lab consoles
Consoles, keyboards and monitors in data halls, network rooms and labs can display live administrative sessions to anyone standing nearby. These are usually inside a secure area already covered by A.7.6 Working in secure areas, but the clear screen element still needs its own scope line. Record which consoles are present, whether they lock after a set period, and whether maintenance staff leave sessions open between tasks. Document the decision for consoles that cannot be locked, since the Statement of Applicability must explain any control that is not applied.
Removable media such as USB drives
USB drives, external disks, memory cards and optical media carry papers and data out of the controlled environment, and they are often left in drawers or on desks. The scope should cover every media type the organization permits, how it is issued and tracked, and whether personal media may be connected to company devices. Link this card to A.7.10 Storage media, since the handling and disposal rules there govern what the clear desk rule protects. Check whether endpoint policy can block or log removable media, because that evidence is easier to produce than a desk walk record.
How an assessor tests clear desk and clear screen
This table walks through each step an assessor typically takes for A.7.7, from reading the written rules to sampling desks, screens and printers, and shows the evidence requested at each step. Use it to prepare the evidence before fieldwork and to see where findings usually come from.
| Assessment step | What the assessor checks | Evidence requested | Common findings |
|---|---|---|---|
| Review the written rules | Whether a clear desk policy covers papers and removable storage media, and a clear screen rule covers information processing facilities | Approved policy or standard with owner, version and approval date; links to related acceptable use and endpoint rules | Rules exist only in an onboarding deck, or they omit removable media or printers |
| Confirm the rules reach staff and contractors | Whether employees, contractors and temporary staff received and acknowledged the rules | Acknowledgment records, awareness training completion lists, contractor onboarding terms | Contractors on site were never given the rules; acknowledgments are missing for recent joiners |
| Walk floors and shared areas after hours | Whether papers, notebooks, media and badges are left on desks, and whether sensitive documents sit in open areas | Walk-through notes, photographs taken with permission, and records of who performed the check and when | Documents left on desks, sticky notes with credentials, unlocked drawers holding media |
| Spot-check screens | Whether idle workstations lock and whether screens show sensitive data to passers-by | Screenshots or observed lock state at sampled desks, and the time an idle session was left open | Unlocked idle sessions, screens visible from corridors, sessions left logged in overnight |
| Sample endpoint lock settings | Whether the automatic screen lock timeout is configured and enforced on sampled devices | Configuration exports or policy reports from device management or endpoint tools, with a sample list and results | Lock timeout set differently across device groups, or policy applied to some fleets only |
| Check printer and output device handling | Whether printed material is collected promptly and whether secure print release is used for sensitive output | Print policy, secure print settings, collection logs or procedures, and output device placement | Sensitive reports left in output trays, unattended multifunction devices in public areas |
| Check whiteboards and meeting rooms | Whether whiteboards and flip charts are erased or covered after sensitive discussions | Meeting room procedures, cleaning or facilities instructions, and spot-check records | Customer data or credentials left on whiteboards after meetings |
| Check removable media handling | Whether USB drives and other removable media are stored, labeled and controlled when not in use | Removable media rules, inventory or approved device list, and links to A.7.10 handling records | Unmanaged USB drives in desk drawers, personal media used for business files |
| Interview staff | Whether staff can state the rules and apply them in their own work | Interview notes and a short list of the questions asked, with roles interviewed | Staff unaware of the screen lock timeout or unsure whether removable media is permitted |
How to implement clear desk and clear screen step by step
This sequence turns A.7.7 from a policy statement into working rules, trained people and recorded checks, so an auditor can see that clear desk and clear screen are defined and enforced across the areas and devices in scope.
Scope the areas and device types
Start by listing every area where papers, removable media or information processing equipment appear: offices, reception, meeting rooms, print corners, secure areas and home or remote workspaces where the policy applies. Next, list the device types in each area, such as laptops, desktops, tablets, shared terminals, printers, copiers and whiteboards. The output is a written scope register that names each area, its owner and the devices it contains, agreed by the information security owner and facilities. Confirm the list against your asset inventory so no device type is missing.
Write the clear desk and clear screen rule
Draft a short rule that covers papers, removable storage media and screens. For papers, state what must be locked away or removed from view when a person leaves a workspace. For removable storage media, state where USB drives, optical disks and similar media are kept and how they are secured when unattended. For output devices, state that printed material is collected promptly and not left at shared printers. Approve the rule through your management system governance and link it to the removable media and storage media rules that sit under A.7.10. The output is a versioned, approved policy document.
Set automatic screen lock standards by device type
Define a screen lock standard for each device category from the scope register, including the idle time before a lock, the authentication required to unlock, and whether the lock applies to shared or kiosk terminals. Set these values in the operating system or device management platform rather than relying on user habit. Where you run Wazuh Security Configuration Assessment, compare endpoint settings with a policy that checks the lock configuration. Where you run Fleet, write a policy query that asks each device whether its lock is active. The output is a documented standard per device type with the configuration evidence that proves it is applied.
Configure printer and whiteboard practice
Set the rules for output devices and writing surfaces in each area. For printers and copiers, decide whether secure print release, PIN collection or a documented collection routine applies, and confirm the device settings that support it. For whiteboards, define when content must be erased after meetings and who checks. Record the configuration of each shared printer and the cleaning routine for each board. The output is a configuration record and a short procedure that people in each area can follow, with the responsible role named for every device.
Communicate the rules and collect acknowledgments
Publish the policy and the area-specific procedures where people will see them, and include the rules in onboarding and periodic awareness training. Ask each person in scope to acknowledge the rules electronically, and keep the acknowledgment with the date and the version they accepted. Brief facilities, reception and cleaning staff separately, because they often handle papers left behind. The output is a completed acknowledgment record for the population in scope and a briefing log for each team that supports the rules.
Run compliance checks on desks and screens
Schedule recurring checks of desks, shared printers, whiteboards and device settings across the scoped areas. Physical walk-throughs record unlocked cabinets, unattended papers, media left in view and screens without locks. Technical checks confirm lock settings on endpoints through your device management or configuration tooling. Auditors commonly spot-check desks and screens in this way, so keep dated records of each check, what was found and who reviewed it. The output is a check log per area that shows the rule was tested, not only written.
Record exceptions and corrective actions
Log every finding from the checks, every approved exception and every corrective action. An exception needs a named approver, a business reason, a compensating measure and a review point. A corrective action needs an owner, the action taken and evidence that it worked, such as a follow-up check showing the finding was closed. Feed repeated findings into awareness content and into the internal audit or management review cycle. The output is an exception register and corrective action records that show how the organization responds when clear desk or clear screen rules fail.
How endpoint configuration checks produce clear screen evidence
Automatic screen lock is one of the few clear screen settings an assessor can verify without standing at a desk. The lock timeout, the requirement for a password on wake and similar settings live in endpoint configuration, so a configuration check run across the fleet can show which devices enforce them. That check produces evidence of configuration, not of behavior. Wazuh Security Configuration Assessment fits this need. It scans monitored endpoints against YAML policies, most of which are based on CIS benchmarks and can be extended with custom policies, and it checks files, directories, registry keys and running processes. Its results include remediation recommendations, which helps when a device fails.
Fleet policies offer a simpler route. Each policy is a yes or no osquery question asked of every device, and the policies page shows which devices in each fleet pass or fail. A policy asking whether screen lock is enabled with a short timeout can be reviewed as a dated export. Confirm with the vendor which checks each platform supports on your operating systems, since screen lock settings differ between Windows, macOS and Linux desktops, and some checks may need a custom policy.
Configuration results do not show whether people leave sessions open on a printer, a whiteboard or a shared desk. Keep physical spot-check records alongside the scan output, noting the date, the area, what was found and the follow-up. Record exceptions too, such as a kiosk that is approved to run without a lock, with the reason and an owner. Auditors compare the two sources, so a passing configuration report with no desk checks will raise questions.
Evidence that passes A.7.7 and how to keep it current
An auditor testing A.7.7 looks for a written rule, proof that people know it, and proof that someone checks it. The cards below cover each artifact an assessor usually asks for, plus how to refresh it between audits so the evidence reflects the current state of desks and screens rather than the day the policy was written.
Written clear desk and clear screen rule
This is the policy text that defines what must not be left unattended: paper with personal or confidential information, removable storage media, and unlocked screens in shared or public areas. A dated, approved version with a named owner is the first thing an auditor reads. Check that it covers both halves of the control, papers and removable media on the desk side and devices on the screen side, and that it names the facilities or information processing areas it applies to. Review it on a set schedule and record each review.
Removable media and output device handling standard
Clear desk rules alone do not settle how USB drives, printers, scanners and whiteboards are handled. This standard sets who may connect removable media, how printed output is collected or secured, and how whiteboard content is erased after meetings. Keep the list of approved devices or output locations with it. Ask whether the standard links to the storage media handling rules, since A.7.10 covers the same media from a different angle.
Screen lock configuration baselines and check results
This card holds the configured automatic lock timeout and screen lock settings for each device class, together with exported results showing which endpoints pass. Wazuh Security Configuration Assessment can scan endpoints against YAML policies, mostly based on CIS benchmarks and extendable with custom checks, and report remediation steps. Fleet policies ask yes or no questions of devices as osquery queries, and the policies page shows which devices are passing or failing. Export these results on a recurring schedule so the evidence reflects the current fleet, not a snapshot from one day.
Dated desk spot-check records
Spot-check records show that someone walked the office, photographed or noted what was left out, and followed up. Each record should carry the date, the area, the person who checked, the findings and the corrective action with its owner and closing date. Auditors sample these to see whether checks happen on the stated schedule and whether repeat findings lead to changed behavior. Run and log checks at a defined frequency, and keep the logs even when they show nothing to fix.
Staff acknowledgments of the rules
Acknowledgments show that people who handle information received the clear desk and clear screen rules and agreed to follow them. Store the signed or electronically recorded acknowledgment against each person, and link it to onboarding and to the annual awareness cycle. Check the record for leavers and contractors as well as employees, because an auditor may ask whether a temporary worker in a shared area was briefed. Refresh acknowledgments when the rule changes materially.
Exception approvals
Some areas cannot meet the standard, such as a clinic room with a shared terminal or a production floor where screens must stay visible. Each exception needs a written justification, a named risk owner who accepted it, a compensating measure such as a shorter lock timeout or a privacy screen, and a review date. Auditors test whether exceptions are rare, approved before use, and reviewed on time. Keep the register current and confirm each approved exception still matches the physical layout of the site.
What meeting A.7.7 costs in money and effort
This table breaks down the cost and effort components of meeting A.7.7 Clear desk and clear screen, showing who is paid for each, whether it is one-time or recurring, and what pushes it up. Use it to shape a quote request, since no price list exists and every figure depends on your own fleet, sites and staffing. The main takeaway is that open-source tooling removes license spend but not the engineering, communication and remediation effort that auditors will test.
| Cost component | One-time or recurring | Who is paid and what drives it up |
|---|---|---|
| Clear desk and screen policy drafting | One-time, revised on change | Internal policy owner or consultant. Rises with the number of sites, office types and removable media classes covered. |
| Endpoint screen lock configuration | One-time build, recurring upkeep | Platform engineers set idle timeouts and lock policies. Rises with mixed operating systems and unmanaged devices. |
| Check tooling deployment (for example Wazuh or Fleet) | One-time setup, recurring hosting | Engineering time to deploy and tune self-hosted tools. License spend is removed, but hosting and staff hours remain. |
| Staff communication and training | Recurring, at each onboarding and policy change | Internal managers and HR time. Rises with remote staff, contractors and shift workers who need separate reach. |
| Recurring desk and screen spot-checks | Recurring, on a set schedule | Internal security staff or a contracted assessor. Rises with the number of sites and the frequency you set. |
| Remediation of failing devices | Recurring, driven by check results | Desktop support and device owners. Rises with the number of non-compliant devices and how fast you must close them. |
| Printer, whiteboard and media handling changes | One-time fit-out, occasional upkeep | Facilities and IT. Rises with shared printers, meeting rooms and removable media use across sites. |
| Auditor sampling during certification | Recurring, at each audit cycle | Accredited certification body fees, set by its own quote. Rises with the number of sites sampled and the evidence you must produce. |
Which open-source tools support clear screen and removable media evidence
Wazuh's Security Configuration Assessment (SCA) module scans monitored endpoints for misconfigurations using YAML policies. The shipped policies are mostly based on CIS benchmarks and can be extended with custom policies that check files, directories, registry keys and running processes. For A.7.7, the useful question is whether a policy tests the settings behind automatic screen locks and restrictions on removable storage, and whether a failed check comes with a remediation recommendation.
- Policy coverage: Shipped policies vary by operating system and benchmark version, so confirm which lock timeout and removable media checks exist for each platform in your estate.
- Custom policies: Where a shipped check does not match your standard, write a YAML policy that tests the specific registry key, file or process your build uses.
- Scan results as evidence: Retain dated scan output per endpoint, showing pass and fail results for each check, alongside the scan policy version.
- Remediation trail: Keep the recommended remediation and the ticket or change record that closed each failed check.
- License caveat: Wazuh is licensed under GPL-2.0-only, so confirm with counsel what obligations apply to your modifications and internal distribution of any custom policies.
Before relying on this tab, confirm with your platform team that the agents report from every endpoint type in scope, including those that are off the corporate network for long periods.
Fleet policies are yes or no questions asked of devices as osquery queries. Each policy has a query, and the policies page shows which devices in each fleet are passing or failing it. For A.7.7, a policy can ask whether a screen lock is enabled with a short timeout, or whether a device has an unexpected removable storage configuration, and the result is a per-device pass or fail record that can be exported for review.
- Query-based checks: Write each policy as a specific question, such as whether a screen lock setting is enabled, so the answer is unambiguous for an assessor.
- Fleet-level view: Group devices into fleets by department or risk tier so that failures can be assigned to owners.
- Pass and fail history: Capture the policy definition, the date and the per-device result each time you export evidence for a review cycle.
- Coverage limits: A query only answers for devices enrolled and reporting, so compare the inventory against enrolled devices to find gaps.
- License caveat: Fleet is released under the MIT license, which is permissive, but confirm the version you deploy and any hosted or enterprise features your contract includes.
Before relying on this tab, test each policy on one device per operating system and confirm that the query returns the setting you intend to measure.
Neither Wazuh nor Fleet writes the clear desk policy, and neither can observe a desk, a printer tray, a whiteboard or an unattended screen in a room. Both tools test configuration on endpoints that report to them. Papers, sticky notes, printed output and physical media left on desks fall outside their reach, so A.7.7 still depends on rules, awareness and supervised checks.
- Policy authorship: The organization must define the clear desk rule, the clear screen rule and the handling of printers and whiteboards in its own documents.
- Physical checks: Auditors commonly walk floors and sample desks and screens, so schedule your own walkthroughs and record their results.
- Unmanaged devices: Personal devices, shared kiosks and printers without agents will not appear in tool output unless you add them to scope.
- Shared accounts and terminals: Configuration checks do not show whether a session was left unlocked by a person who walked away.
- Exceptions: Record approved exceptions, such as devices that cannot run a lock, with a named owner and a review date.
Before relying on this tab, ask your assessor how they expect physical desk observations to be documented alongside technical scan results.
Where clear desk and clear screen usually fails an audit
Clear desk and clear screen usually fails on paperwork and consistency rather than on the absence of a policy. The gaps below are the ones assessors most often find when they walk an office or check device settings, and each one has a closing action the organization can own before the audit.
Policy exists but staff never heard of it
A written clear desk rule that sits in the policy library does not satisfy A.7.7 on its own. Assessors ask staff what the rule says, and a few blank answers can undo an otherwise sound document. Check that the rule is in onboarding material, the acceptable use acknowledgment and periodic awareness content, and that people who work in shared or public areas have seen it. Keep the acknowledgment records with dates.
Screen lock timeouts vary by device
Laptops, desktops, mobile devices and shared workstations often carry different lock settings because each was configured by a different person or image. Auditors compare the setting on sampled devices against the documented baseline and flag any gap. Define one minimum idle lock time per device class, enforce it through your management tooling, and report on devices that drift from it.
Printers and whiteboards left out of scope
Output devices and wall surfaces are the places where information is most often left in view. Printed pages collect in trays, and whiteboards keep client names, architecture diagrams or credentials after meetings end. Include these in the clear desk rule with explicit steps: collect prints immediately, use secure print release where available, and erase boards at the end of sessions. Confirm the printer model supports the release feature before relying on it.
Removable media rules missing
The clear desk rule covers removable storage media as well as paper, so USB drives, external disks and memory cards must be addressed in the same document. Many organizations forget them because they sit in a different policy. State where media must be stored when not in use, who may use it, and how it is locked away at the end of the day. Cross-reference the storage media controls so the two sets of rules agree.
No dated spot-check records
Assessors expect evidence that the rule is enforced, not only defined. A spot-check program with dated records shows who walked which areas, what was found and what was corrected. Without those records, the organization cannot show the control operated during the audit period. Schedule checks at varied times, record exceptions with the person responsible, and keep the logs with the control evidence so they can be produced on request.
Home office devices outside checks
Staff who work from home or travel often hold the same information on devices that never pass through office checks or central configuration. Auditors ask whether the screen lock and desk rules apply off-site and whether remote devices report their settings. Extend the lock baseline to managed endpoints wherever they are, include home working in the policy, and confirm that remote devices can be queried for their lock status.
Questions buyers ask about A.7.7 cost, effort and outside help
How much effort does A.7.7 clear desk and clear screen take to implement?
Effort for A.7.7 is usually modest in design but steady in operation. The organization must write a clear desk and clear screen rule that covers papers, removable storage media and information processing facilities, then make people follow it. The main work is agreeing the rule with facilities, IT and business leads, setting screen lock timeouts on endpoints, deciding where printers and whiteboards sit, and communicating the rule to staff. The recurring effort is enforcement: spot checks, follow-up on repeated findings and updates when office layouts or device fleets change. Effort rises with the number of sites, shared workspaces, and the share of staff who work remotely.
Can a small team run A.7.7 on its own?
Yes, a small team can usually run A.7.7 without outside help, because the control is mostly a policy, a configuration baseline and a habit. One person can own the rule, a second can configure screen locks on laptops and desktops through the device management tool already in use, and office managers or team leads can run periodic desk checks. The points that often need a second pair of eyes are the endpoint configuration and the evidence trail, since an auditor will ask for proof that screen locks are enforced, not only that a policy exists. Confirm with the certification body how it expects small organizations to show that the rule is enforced.
What can outside help cover for A.7.7, and what must stay in-house?
An implementation partner can help prepare systems and evidence, while the organization keeps ownership of the control. Outside help typically covers drafting the clear desk and clear screen standard, configuring endpoint lock policies, building compliance checks that report failing devices, and setting up a repeatable evidence routine. The organization must keep ownership of the policy, the decisions about risk acceptance, the staff who enforce the rule, and the management review of the results. Only an independent auditor or certification body can assess conformity and issue a certificate, so no consultant can grant A.7.7 compliance. Ask any partner to state in writing which tasks it performs and which remain with your staff.
How long does preparing for A.7.7 take?
Preparation time depends mainly on the number of sites, the size of the device fleet, how many shared or public areas hold papers or screens, and how much existing policy material can be reused. A single office with managed laptops can often be prepared quickly, while multi-site operations with printers in open areas, varied device types and unmanaged endpoints need longer. Time also depends on how quickly the organization can agree the rule with business owners and how far the current endpoint management can enforce screen locks. No duration is fixed by the standard, so ask any partner for a written scope and a timeline built from your own sites and devices.
How do auditors check clear desks and clear screens?
Auditors usually check A.7.7 by walking through the premises and sampling workstations, then comparing what they see with the written rule and the configuration records. During a walk-through they look for sensitive papers left on desks, unattended removable media, unlocked screens, documents left at printers and whiteboards that still show confidential content. They then ask for evidence that the rule is enforced, such as endpoint configuration reports showing screen lock settings, records of desk checks, and how exceptions are recorded and handled. Expect the auditor to choose its own sample of desks and devices, so routine self-checks matter more than a one-off tidy before the visit.
Which open-source tools can produce evidence that screens lock automatically?
Wazuh and Fleet can both produce evidence for screen lock and related endpoint settings, though the exact checks depend on the operating system and your policies. Wazuh's Security Configuration Assessment scans monitored endpoints against YAML policies, most of which are based on CIS benchmarks, and can be extended with custom checks that test files and settings and recommend remediation. Fleet's policies ask yes or no questions of devices as osquery queries, and its policies page shows which devices pass or fail each policy. Confirm that the checks you need for your operating systems exist or can be written before you commit to either tool.
