ISO 27001:2022 · Physical controls
ISO 27001:2022 7.7: Clear desk and clear screen
ISO 27001:2022 7.7 covers Clear desk and clear screen. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.7.7, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Screen lock timeouts are long or can be disabled by users.
Rules requiring clear desks for papers and removable media and clear screens for processing facilities are to be defined and suitably enforced. Purpose (stated in ISO/IEC 27002:2022): reduces the risk of unauthorized access, loss or damage to information left on desks, screens and other accessible places. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 7.7.
What evidence supports 7.7?
- Annex A physical controlStatement of Applicability entry for control A.7.7, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A physical controlThe topic-specific clear desk and clear screen policy and its communication
- Annex A physical controlConfiguration evidence of screen lock and automatic logout timeouts on endpoints and systems
- Annex A physical controlSecure print or follow-me printing configuration requiring authentication at the device
- Annex A physical controlClear desk walk-round or spot-check records with findings and follow-up
Where this requirement comes from
This is our own statement of ISO 27001:2022 7.7, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Screen lock timeouts are long or can be disabled by users
- Sensitive printouts accumulate uncollected at shared printers
- Whiteboards in meeting rooms retain confidential content
- Notification pop-ups reveal confidential messages during screen sharing
How it maps to SOC 2
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.