Clean Desk Policy

Clean Desk Policy

Authorized By: Chief Information Security Officer (CISO) & Head of People

Purpose/Overview

A clean desk policy is an important tool to ensure that all sensitive, confidential, and Controlled Unclassified Information (CUI) materials are removed from an end-user workspace and locked away when the items are not in use or when an employee leaves their workstation. It is a primary strategy utilized to reduce the risk of security breaches, unauthorized access, and data leakage in the workplace. This policy establishes the minimum requirements for maintaining a ‘clean desk’ to ensure Safire’s intellectual property, customer data, and CUI are secure.

Scope

This policy applies to all Safire employees, contractors, affiliates, and third-party personnel working within Safire facilities or remote environments where Safire assets are used.

Policy

Employees must secure all sensitive/confidential information (hardcopy/electronic) at end-ofday or extended absence:

Workstation and Device Security

• Locking Screens: Computer workstations must be locked (Win+L or Mac equivalent) whenever the workspace is unoccupied, regardless of the duration of the absence (e.g., going to the restroom, getting coffee).
• End of Day: Computer workstations must be logged off or locked at the end of the workday. (Note: Systems should generally remain powered on to facilitate automated nightly security patching updates, unless otherwise directed by IT).
• Portable Devices: Laptops, tablets, and other portable computing devices must be either secured with a physical cable lock or locked away in a drawer/cabinet when not in use.
• Passwords: Passwords may not be written down and left in an accessible location. Specifically, sticky notes containing passwords must not be posted on monitors, under keyboards, or on desks.

Physical Documents and Media

• Secure Storage: Any Restricted, Sensitive, Confidential information, or CUI (hardcopy or electronic media) must be removed from the desk surface and locked in a drawer or filing cabinet when the desk is unoccupied and at the end of the work day.
• File Cabinets: Cabinets containing Restricted or Sensitive information must be kept closed and locked when not in active use or when unattended.
• Keys: Keys used for access to drawers or cabinets containing sensitive information must not be left at an unattended desk.
• Storage Media: Mass storage devices such as CD-ROMs, DVDs, USB drives, or external hard drives must be treated as sensitive assets and secured in a locked drawer.

Common Areas and Peripheral Equipment

• Printers/Copiers/Fax: Employees must clear papers from printers and fax machines immediately upon printing. “Secure Print” features (requiring a PIN at the device) should be utilized for sensitive documents or CUI where available.
• Disposal: Upon disposal, Restricted, Sensitive, or CUI documents must be shredded immediately in official shredder bins or placed in locked confidential disposal consoles. They may not be placed in open recycling or trash bins.
• Whiteboards: Whiteboards containing Restricted or Sensitive information must be erased completely after meetings or when the room is vacated.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions to this policy must be approved by the Policy Owner.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• Physical Security Policy
• Data Classification Policy
• Media Protection Policy

Referenced Terms

CUI

Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies.

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page