404 Tech Support

Understanding a Clear Desk Policy

A Clear Desk Policy (CDP) or sometimes called a Clean Desk Policy is a security practice that might be put in place at an organization. A clear desk policy explains how an employee is to leave their workspace when they leave at the end of the day. For example, a desk should be clear of all papers when leaving the office for the evening. Like other good policies, a CDP explains what is expected of the employee, how compliance is monitored, and consequences should the policy not be followed. The policy would be a signed contract between the employee and their manager.

A CDP offers many benefits to an organization to improve general organization and information security. It would prevent any prying eyes from seeing information that they should not, such as a cleaning crew that comes in after hours. It also makes it less likely for somebody to grab a “scratch” piece of paper with sensitive information on one side to take notes and give out to an outside audience. Along with better organization, it can help the employee better detect if somebody has been looking through their documents. If everything has its place and they notice the next day that things are shifted, an employee is more likely to catch that somebody has been going through their stuff.

A Clear Desk Policy might also be implemented to be compliant with ISO 27001. A CDP also works hand-in-hand with a Clear Screen Policy, so that a computer is password-protected and locked whenever it is left unattended. For more reading, you might check out this article from PrivacySense.net explaining a Clear Desk Policy and a Clear Screen Policy.

SANS has a desktop security policy examples with a template for a Clean Desk Policy.