Clear Desk and Clear Screen policy
1. Objective
A clean desk policy can be an important tool to ensure that all sensitive/confidential materials are removed from an end-user workspace and locked away when the items are not in use, or an employee leaves his/her workstation. It is one of the top strategies to utilize when trying to reduce the risk of security breaches in the workplace. Such a policy can also increase employees’ awareness about protecting sensitive information.

The objective of this policy is to establish the minimum requirements for maintaining a “clean desk” – where sensitive/critical information about our employees, our intellectual property, our customers, and our vendors is secure in locked areas and out of site. A Clean Desk policy is not only ISO 27001/17799 compliant, but it is also part of standard basic privacy controls.
2. Scope

This policy applies to:

  1. All staff members working for Icanio Technology Labs Private Limited (Icanio) who have access to the organization’s and/or client’s information.
  2. All staff members, vendors, and third-party employees who have access to Icanio information processing systems and the data contained in them. This includes the data accessed by licensed third parties, which is, in turn, deployed to and used by their clients.
  3. All stakeholders and interested parties who are relevant to the operations of Icanio.
3. Roles and Responsibilities
  1. The Information Security Steering Committee (ISSC) is responsible for reviewing and approving the policy and ensuring that it reflects the current requirements of Icanio.
  2. The ISO is responsible for the development, maintenance, reviewing, approval and publishing of this policy.
  3. The CISO is responsible for enforcing this policy throughout Icanio.
4. Policy Statements
  1. Employees are required to ensure that all sensitive/confidential information in hardcopy or electronic form is secure in their work area at the end of the day and when they are expected to be gone for an extended period.
  2. Computer workstations must be locked when the workspace is unoccupied.
  3. Computer workstations must be shut completely down at the end of the workday.
  4. Any Restricted or Sensitive information must be removed from the desk and locked in a drawer when the desk is unoccupied and at the end of the workday.
  5. File cabinets containing Restricted or Sensitive information must be kept closed and locked when not in use or when not attended.
  6. Keys used for access to Restricted or Sensitive information must not be left at an unattended desk.
  7. Laptops must be either locked with a locking cable or locked away in a drawer.
  8. Passwords may not be left on sticky notes posted on or under a computer, nor may they be left written down in an accessible location.
  9. Printouts containing Restricted or Sensitive information should be immediately removed from the printer.
  10. Upon disposal Restricted and/or Sensitive documents should be shredded in the official shredder bins or placed in the locked confidential disposal bins.
  11. Whiteboards containing Restricted and/or Sensitive information should be erased.
  12. Lock away portable computing devices such as laptops and tablets.
  13. Treat mass storage devices such as CDROM, DVD, or USB drives as sensitive and secure them in a locked drawer.
  14. All printers and fax machines should be cleared of paper as soon as they are printed; this helps ensure that sensitive documents are not left in printer trays for the wrong person to pick up.
5. Compliance
5.1 Compliance Measurement
  • The CISO will verify compliance with this policy through various methods, including but not limited to, periodic walk-throughs, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner.

5.2 Exceptions
  • Any exception to the policy must be approved by the CISO in advance.

5.3 Non-Compliance
  • An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

6. Enforcement of Policy
All employees of Icanio, contractors, vendors, and other third-party users who require access to information and associated assets are responsible for ensuring that this policy is adhered to. Management is responsible for ensuring that the users are aware of and adhere to, this policy.

Violation of information security policies should result in corrective action by the management. Disciplinary action should be taken in accordance with the severity of the violation, as determined by an investigation, and may include, but not limited to:
  1. Revocation of access privileges to information assets.
  2. Termination of employment/contract.
  3. Other actions as deemed appropriate by the Icanio’s management as per law.
7. Maintenance of Policy

Compliance with this policy should be audited on a yearly basis; exceptions identified during the audit should be immediately and appropriately addressed. The policy should be reviewed annually unless there is a major change in the organization or the environment affecting the organization, in

which case it should be done on a need basis. The policy should be reviewed and revised whenever a major security risk or an incident is identified.

8. References

ISO 27001:2022

Version
Date
Revision Author
Summary of Changes
Approved By
Position
0.1
01.08.2024
Green IT Ventures
Draft

 1.0

01.10.2024

Green IT Ventures

Initial release

Jebastin Prabhaharan

CEO

 
DECLARATION:

This is to confirm that I have read and understood the above mentioned policy.

Click here to fill the acknowledgement form.