Content library
ISO 27001 (2013): Full
11.2.9: Clear desk and clear screen policy

Requirement description

How to fill the requirement

ISO 27001 (2013): Full

11.2.9: Clear desk and clear screen policy

Task name
Priority
Status
Theme
Policy
Other requirements
Personnel guidelines for file usage and local data
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Management of data sets
Management of data sets
12
requirements

Examples of other requirements this task affects

7.2.2: Information security awareness, education and training
ISO 27001
11.2.9: Clear desk and clear screen policy
ISO 27001
6.6.4: Fyysisten tilojen, laitteiden ja tulosteiden turvallisuus
Omavalvontasuunnitelma
FYY-04: Tiedon säilytys
Julkri
5.10: Acceptable use of information and other associated assets
ISO 27001
See all related requirements and other information from tasks own page.
Go to >
Personnel guidelines for file usage and local data
1. Task description

Especially when local or unstructured data needs to be handled a lot due to the nature of the activity, it may be necessary to develop training that describes the risks involved for staff.

Common problems with local and unstructured data include e.g.:

  • no backups
  • no access management
  • hard to locate

For data you do not want to lose, that you want to control, or that is important to find in the future, staff should use data systems designed for it.

Personnel guidelines for safe processing of personal and confidential data
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Privacy
Processing principles and accountability
29
requirements

Examples of other requirements this task affects

29. Processing under the authority of the controller or processor
GDPR
7.2.2: Information security awareness, education and training
ISO 27001
18.1.4: Privacy and protection of personally identifiable information
ISO 27001
12.1.1: Documented operating procedures
ISO 27001
11.2.8: Unattended user equipment
ISO 27001
See all related requirements and other information from tasks own page.
Go to >
Personnel guidelines for safe processing of personal and confidential data
1. Task description

The Data Protection Officer (or other responsible person) has drawn up operating instructions for personnel handling personal data. In addition, the Data Protection Officer is ready to advise the controller, personal data processing partners or their own staff on compliance with GDPR or other data protection requirements.

Locked cabinets for storing confidential paper data
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Physical security
Non-electronic data and copies
4
requirements

Examples of other requirements this task affects

11.2.9: Clear desk and clear screen policy
ISO 27001
7.7: Clear desk and clear screen
ISO 27001
See all related requirements and other information from tasks own page.
Go to >
Locked cabinets for storing confidential paper data
1. Task description

If sensitive paper information is required, there are safes, other lockers or other secure furniture for storing it.

Sensitive information must not be lurking available to anyone around the office.

Endpoint PIN-protection and automated locking
Critical
High
Normal
Low
Fully done
Mostly done
Partly done
Not done
Remote work and mobile devices
Mobile device management
5
requirements

Examples of other requirements this task affects

11.2.9: Clear desk and clear screen policy
ISO 27001
6.6.4: Fyysisten tilojen, laitteiden ja tulosteiden turvallisuus
Omavalvontasuunnitelma
7.7: Clear desk and clear screen
ISO 27001
SEC-06: Reviewing password practices on password protected systems
Cyber Essentials
See all related requirements and other information from tasks own page.
Go to >
Endpoint PIN-protection and automated locking
1. Task description

Devices should be protected against unauthorized access to or disclosure of information stored on or processed by them. Mandatory protection of the devices, e.g. with a 5-digit PIN code before each use, and automatic locking of the devices, e.g. after 5 minutes of inactivity, can help.

Tasks included in the policy

Task name
Priority
Status
Theme
Policy
Other requirements
No items found.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way
Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.
Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.
Do it once - we automatically apply it to all current and future frameworks.
Get to know Cyberday
Start your free trial
Cyberday is your all-in-one solution for building a secure and compliant organization. Whether you're setting up a cyber security plan, evaluating policies, implementing tasks, or generating automated reports, Cyberday simplifies the entire process.
With AI-driven insights and a user-friendly interface, it's easier than ever to stay ahead of compliance requirements and focus on continuous improvement.
Clear framework compliance plans
Activate relevant frameworks and turn them into actionable policies tailored to your needs.
Credible reports to proof your compliance
Use guided tasks to ensure secure implementations and create professional reports with just a few clicks.
AI-powered improvement suggestions
Focus on the most impactful improvements in your compliance with help from Cyberday AI.