What is a clean desk policy?
A clean desk policy is a workplace rule that sensitive information must never be left unattended where someone else could see or take it. When employees step away, their screens are locked; at the end of the day, papers, notebooks and removable media go into locked storage. The policy targets a low-tech problem that firewalls and encryption can't solve: confidential data lying in plain sight on desks, printers, whiteboards and sticky notes.
What the policy typically requires
- Lock the computer every time you leave it, even briefly: Windows key + L on Windows, Control + Command + Q on a Mac.
- Put documents, notebooks, USB drives and laptops in locked drawers or cabinets before going home.
- Pick up print jobs right away. Many organizations use secure print release, so a document prints only when its owner badges in at the printer.
- Erase whiteboards and remove flip-chart pages when a meeting ends.
- Never write passwords down, whether on sticky notes, under keyboards or on the edge of a monitor.
- Put sensitive paper you no longer need in locked shredding bins, not ordinary trash or recycling.
- Keep keys, badges and hardware tokens on your person or locked up.
Why it matters
Unattended information is exposed to more people than most organizations realize: visitors, couriers, cleaning and maintenance contractors, coworkers without a need to know, and anyone on the other side of a video call. A clean desk policy blunts several attacks at once:
- Shoulder surfing and snooping on unlocked screens and open documents.
- Dumpster diving through paper that should have been shredded.
- Intruders who tailgate or impersonate staff to get inside, then collect passwords, network diagrams and customer files in minutes.
- Insider misuse by colleagues who shouldn't see payroll or medical records.
It also supports compliance. ISO/IEC 27001 includes clear desk and clear screen rules among its Annex A controls, and auditors routinely walk the floor looking for exposed information.
Enforcing it
A rule on paper changes little by itself, so organizations back it with technical and procedural controls. Group Policy or MDM forces a screen lock after a few minutes of inactivity. Secure print release keeps documents queued until the owner arrives. Facilities supply lockable drawers and shred bins so that complying is easy. Security or facilities staff walk the office after hours and leave a notice, or log a violation, when they find an unlocked screen or exposed papers, and repeat findings go to the employee's manager. Hybrid work extends the rule to home offices: no confidential printouts on the kitchen table, and nothing sensitive visible behind you on camera.
Clean desk policy vs. related controls
- Acceptable use policy: governs how people use company systems and data, not whether they secure their workspace.
- Screen lock: a technical control that enforces one part of the clean desk rule automatically.
- Data classification: decides which information is sensitive; the clean desk policy says how to keep it out of sight.
- Privacy filters: narrow a monitor's viewing angle in public spaces. They reduce shoulder surfing but don't replace locking the screen.
Clean desk policy on the CompTIA Security+ exam
The clean desk policy is one of the security policies named in SY0-801 objective 5.1, which covers governance documents and why they matter. Scenario clues include passwords on sticky notes, papers left out overnight, unattended unlocked workstations and a visitor photographing a whiteboard; each points to a clean desk failure. The common distractor is the acceptable use policy, which covers misuse of systems rather than an unsecured workspace. If the question asks instead for a technical control that enforces part of the rule, an automatic screen lock is the better answer.