by peter

Share

CLEAR DESK POLICY

POLICY STATEMENT

A clear desk policy can be an import tool to ensure that all sensitive/confidential materials are removed from an end user workspace and locked away when the items are not in use or an employee leaves his/her workstation. It is one of the top strategies to utilise when trying to reduce the risk of security breaches in the workplace. A good clear desk policy can also increase employee’s awareness about protecting sensitive information and keep them safe.

PURPOSE

The purpose for this clear desk policy is to establish the minimum requirements for maintaining a “clean desk” – where sensitive/critical information about our employees, our intellectual property, our customers and our vendors is secure in locked areas and out of site. A Clean Desk policy is not only ISO27001:2013 compliant, but it is also part of standard basic privacy controls.

SCOPE

This clear desk policy applies to employees, contractors, consultants, temporaries, and other workers at {{company_name}}, including all personnel affiliated with third parties.

CLEAR DESK POLICY

General Use and Ownership

  1. Employees are required to ensure that all sensitive/confidential information in hardcopy or electronic form is secure in their work area at the end of the day and when they are expected to be gone for an extended period.
  2. Computer workstations must be locked when workspace is unoccupied.
  3. Computer workstations must be shut completely down at the end of the work day.
  4. Computer Screens, whiteboards and similar must be kept free from passwords and confidential information.
  5. Any Restricted or Sensitive information must be removed from the screen and desk and locked in a drawer when the desk is unoccupied and at the end of the work day.
  6. File cabinets containing Restricted or Sensitive information must be kept closed and locked when not in use or when not attended.
  7. Keys used for access to Restricted or Sensitive information must not be left at an unattended desk.
  8. Laptops must be either locked with a locking cable or locked away in a drawer.
  9. Passwords may not be left on sticky notes posted on or under a computer, nor may they be left written down in an accessible location.
  10. Printouts containing Restricted or Sensitive information should be immediately removed from the printer.
  11. Upon disposal Restricted and/or Sensitive documents should be shredded in the official shredder bins or placed in the lock confidential disposal bins.
  12. Whiteboards containing Restricted and/or Sensitive information should be erased.
  13. Lock away portable computing devices such as laptops and tablets.
  14. Treat mass storage devices such as CDROM, DVD or USB drives as sensitive and secure them in a locked drawer
  15. All printers and fax machines should be cleared of papers as soon as they are printed; this helps ensure that sensitive documents are not left in printer trays for the wrong person to pick up

POLICY COMPLIANCE

Compliance Measurement

The {{company_name}} Team will verify compliance to this policy through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the policy owner.

Exceptions

Any exceptions to the policy must be approved by the CEO in advance.

Non-Compliance

Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

RELATED STANDARDS, POLICIES AND PROCESSES

Talk To A Security Specialist

Book a free consultation with a security specialist to discuss your current concerns or security requirements.

Hedgehog Security needs the contact information you provide to us to contact you. You may unsubscribe from these communications at any time.  By clicking "Request Callback" below you agree for us to store and process your data.  For information on how to unsubscribe please review our Privacy Policy.

Cyber Security Consulting

Penetration Testing

SOC as a Service

Cyber Essentials

Vulnerability Scanning