A.7.7 Clear desk and clear screen
Control Objective
Clear desk rules for papers and removable storage media and clear screen rules for information processing facilities shall be defined and appropriately enforced.
Policy Statement
anDREa enforces strict Clear Desk and Clear Screen baselines across all remote working and home office environments. This minimizes the risk of unauthorized physical viewing ("shoulder surfing"), theft, or exposure of sensitive data and corporate systems by unauthorized individuals, family members, or third parties.
Clear Desk Policy
Because anDREa is a remote-first organization, the physical workspace at an employee's remote location must be treated with the same diligence as a traditional corporate office:
- General Workspace Hygiene: Personnel must keep their immediate workspace clear of loose, sensitive, or confidential information when unattended. Desks must be fully cleared at the conclusion of each working day.
- Document and Media Lifecycle: Hardcopy documents containing non-public information must be stored in locked drawers, file cabinets, or secure storage when not in use. Any physical document containing sensitive data must be securely shredded or destroyed immediately once it is no longer required (see Retention & Destruction Policy).
- Peripheral Management: Removable media carriers (such as encrypted USB drives) must not be left loose on the desk and must be stored securely when not actively processing data.
Clear Screen Policy
Digital displays must be aggressively defended against unauthorized oversight through automated and manual locking procedures:
-
Manual Device Locking: Personnel must explicitly lock their screens immediately upon stepping away from their workspace, regardless of the duration.
- Windows: Press
Windows Key + LorCtrl + Alt + Del. - Chromebooks: Press
Search + L. - macOS: Press
Ctrl + Cmd + Q.
- Windows: Press
-
Automated Timeout Fallbacks: In the event an employee fails to lock a device manually, automated inactivity thresholds are enforced via corporate MDM:
-
Computers/Laptops: Configured to automatically lock after a maximum of 5 minutes of inactivity. Temporary overrides are permitted only when an active business task requires an extended display state, provided the device remains fully attended.
-
Mobile Phones & Tablets: Configured to automatically lock after a maximum of 1 minute of inactivity. Temporary overrides are allowed only if the device is continuously attended.
-
Authentication Standards: All screen locks must require strong verification to unlock, utilizing industry-accepted biometric authentication, secure PINs, or alphanumeric passwords.
-
Public and Shared Spaces: Displaying High/Confidential information on portable devices in public venues (e.g., trains, cafes) must be strictly managed to prevent visual compromise. Screens must be angled away from public view, and the use of physical privacy filters is highly encouraged.
Compliance and Peer Accountability
Maintaining a secure perimeter is a shared responsibility. anDREa utilizes a collaborative peer-review mechanism to enforce these habits:
- First Incident: If an employee observes a peer deviating from these desk or screen rules, they must communicate the finding directly to the individual as an immediate reminder.
- Recurrence: If the deviation occurs more than once or is part of a repeated pattern, the observer must report the behavior to the individual's direct manager to initiate corrective guidance.