A Clear Desk policy can be an important tool to ensure that all sensitive/confidential materials are removed from an end user workspace and locked away when the items are not in use or an employee leaves his/her workstation. It is one of the top strategies to utilize when trying to reduce the risk of data protection and/or security breaches in the workplace. Such a policy can also increase employee’s awareness about protecting sensitive information.
Equally with multiple organisations as well as visitors being based on company premises it is vital we protect their interests and security.
The purpose for this policy is to establish the minimum requirements for maintaining a “clear desk” – where sensitive/critical information about our employees, our intellectual property, our customers and our vendors is secure in locked areas and out of site. A Clear Desk policy is not only ISO 27001/17799 compliant, but it is also part of standard basic privacy controls.
This policy applies to all Infinity Works Consulting employees and affiliates.
Employees are required to ensure that all sensitive/confidential information in hardcopy or electronic form is securely locked away in their work area at the end of the day and when they are expected to be gone for an extended period.
Computer workstations must be locked when workspace is unoccupied.
At the end of the work day all laptops or computer workstations must be rendered inactive (i.e. completely shut down, or at the very least put into hibernate or sleep mode).
Any restricted or sensitive information must be removed from the desk and locked in a drawer when the desk is unoccupied and at the end of the work day.
File cabinets containing restricted or sensitive information must be kept closed and locked when not in use or when not attended.
Keys used for access to restricted or sensitive information must not be left at an unattended desk.
Where laptops may be left unattended for a significant period of time, they must be either locked with a locking cable or locked away in a drawer. Cables are available from the Administration team.
Passwords may not be left on sticky notes posted on or under a computer, nor may they be left written down in an accessible location.
Printouts containing restricted or sensitive information should be immediately removed from the printer.
Upon disposal restricted and/or sensitive documents should be shredded in the official shredder bins or placed in the lock confidential disposal bins.
Whiteboards should not be used for displaying restricted and/or sensitive information.
Lock away portable computing devices such as laptops and tablets.
Treat mass storage devices such as CDROM, DVD or USB drives as sensitive and secure them in a locked drawer. Personal data (as defined in the Data Protection Act 2018) must not be stored on such mass storage devices.
All printers and fax machines should be cleared of papers as soon as they are printed; this helps ensure that sensitive documents are not left in printer trays for the wrong person to pick up.
The ISMS Committee will verify compliance to this policy through various methods, including but not limited to, periodic walkthroughs, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner.
Any exception to the policy must be approved by the ISMS Committee in advance.
An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
None.
None.