ISO 27001:2022 Annex A Control 7.7

General Guidance on ISO 27001:2022 Annex A 7.7

Annex A 7.7 recommends creating and enforcing a topic-specific policy that outlines rules for clear desks and clear screens.

Furthermore, Annex A 7.7 specifies seven specific requirements that organisations should consider when establishing & enforcing clear desk and clear screen policies:

• Digital and physical assets containing sensitive or critical information should be locked securely when not in use or when the workstation hosting them is empty. For example, paper records, laptops, and printers should be stored in secure furniture such as drawers or cabinets with locks.
• Employee-used devices, such as laptops, scanners, printers, and notebooks, should be protected with key locks when not in use or left unattended.
• Employees should leave their devices logged off when leaving their workspace and leaving them unattended. Reactivating the device should only be possible with user authentication. All endpoint employee devices, such as computers, should have automatic time-out and log-out features.
• The printer should be designed so that printouts can be collected immediately by the person who printed them (originator). Furthermore, only the originator should be allowed to collect the printouts through a robust authentication mechanism.
• Material containing sensitive information, including removable media, should be kept secure at all times. Upon no longer needing them, they should be disposed of in a secure manner.
• It is essential for organisations to create rules for displaying pop-ups on screens and to communicate these rules to all relevant employees. For example, pop-ups (such as email notifications) that contain sensitive information may compromise the confidentiality of sensitive information if displayed during a presentation or in a public space.
• Whiteboards should be erased when sensitive or critical information is no longer needed.

Supplementary Guidance on Annex A 7.7

ISO 27001 Annex A 7.7 warns organisations about risks arising from vacated facilities. Physical and digital materials previously stored in a facility should be securely removed when an organisation vacates to prevent the loss of sensitive information.

Therefore, Annex A 7.7 stipulates that organisations should establish procedures for the vacation of facilities to ensure that sensitive information assets are disposed of securely. A final sweep may be performed to ensure no sensitive information is left unprotected.

What Are the Changes and Differences From ISO 27001:2013?

ISO 27001:2022 Annex A 7.7 replaces ISO 27001:2013 Annex A 11.2.9 (‘Clear Desk & Screen Policy‘).

There are two noteworthy differences between the ISO 27001:2022 and the ISO 27001:2013 versions:

• The ISO 27001:2022 version does not include criteria to consider when establishing & implementing clear desk and clear screen policies.

While the 2013 version specifies that organisations should consider organisation-wide information classification levels, legal & contractual requirements, and the types of risks they face when founding a clear desk and clear screen policy.

The ISO 27001:2022 version, however, does not mention these elements. The ISO 27001:2022 standard introduces new and more comprehensive requirements for clear desks and clear screens.

The ISO 27001:2022 version specifies the following requirements that organisations should take into account when establishing clear desk and clear screen policies:

• Organisations should maintain the confidentiality of sensitive information by creating specific guidelines on pop-up screens.
• Remove the sensitive information written on a whiteboard if you no longer need it.
• Computers and other endpoint devices used by employees should be protected with key locks when not in use or unsupervised.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

ISO 27001:2022 implementation and compliance is simple with our step-by-step checklist that guides you through the whole process.

Your complete compliance solution for ISO/IEC 27001:2022:

• Up to 81% progress from the moment you log in.
• Simple and total compliance solution for ISO 27001:2022.

To schedule a demo, get in touch today.