Sample Clean Desk Policy

April 01, 2009 — CSO —

Clean Desk Policy

1. Overview
a. The purpose for this policy is to establish a culture of security and trust for all employees at (company). An effective clean desk effort involving the participation and support of all (Company Name) employees can greatly protect paper documents that contain sensitive information about our clients, customers and vendors. All employees should familiarize themselves with the guidelines of this policy.

2. Purpose
a. The main reasons for a clean desk policy are:
i. A clean desk can produce a positive image when our customers visit the company.
ii. It reduces the threat of a security incident as confidential information will be locked away when unattended.
iii. Sensitive documents left in the open can be stolen by a malicious entity.

3. Responsibility
a. All staff, employees and entities working on behalf of are subject to this policy

4. Scope
a. At known extended periods away from your desk, such as a lunch break, sensitive working papers are expected to be placed in locked drawers.
b. At the end of the working day the employee is expected to tidy their desk and to put away all office papers. (Company) provides locking desks and filing cabinets for this purpose.

5. Action
a. Allocate time in your calendar to clear away your paperwork.
b. Always clear your workspace before leaving for longer periods of time.
c. If in doubt - throw it out. If you are unsure of whether a duplicate piece of sensitive documentation should be kept - it will probably be better to place it in the shred bin.
d. Consider scanning paper items and filing them electronically in your workstation.
e. Use the recycling bins for sensitive documents when they are no longer needed.
f. Lock your desk and filing cabinets at the end of the day
g. Lock away portable computing devices such as laptops or PDA devices
h. Treat mass storage devices such as CDROM, DVD or USB drives as sensitive and secure them in a locked drawer

6. Enforcement
a. Any employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.