Clean Desk Policy - order for more IT security!

By the end of the day, everything has to be off the table - the Clean Desk Policy ensures more order, but also more IT security? In some employment contracts, it is already firmly written into the contract: The obligation to keep the desk clean. Often this includes paper, but occasionally also personal matters such as a picture. Paper is patient - the saying says it all. Because it does not harm the paper. But sensitive information is then visible to anyone who has access to the desk.

Sensitive documents and personal data should not be visible and accessible!

There are indeed many reasons for a clean desk policy. One is that the largest business risk worldwide is cyber risk. If everything is sorted, filed, and put away directly, there's less flying around. This results in less time spent searching for documents. But the constant clearing up and putting away has other advantages. Unauthorised persons, such as cleaning staff, cannot gain access to the documents. In the context of IT security, much of the Clean Desk Policy aims to ensure that information is not carelessly made available to unauthorized third parties. Criminals only need a very short time to exchange hardware. It does not have to be the often used mouse or keyboard. The replaced, but manipulated iPhone cable is also sufficient. But also other persons with access rights do not have to be served the valuable information on the tablet. This does not mean post-its with passwords. https://www.youtube.com/watch?v=NVWn4hETb8Q

There are controls to eliminate the chaos.

In times of flexible workplaces, tidying up the workplace is obligatory anyway. But even where there is a fixed seating arrangement, the Clean Desk Policy can be effective. And if you take the instructions as seriously as a no-stopping sign, you may be surprised by before-and-after pictures of the desk.

In various auditing companies, documents and technology left lying around are collected in the evening. Anyone wanting to get their equipment back had to report to the service department.

Where to start:

1. Clean out your desk thoroughly. An English-language template is provided by the SANS Institute.
2. Treat information such as QR codes as sensitive too.
3. Shred documents that are no longer needed, in line with the GDPR. Note that there have been minimum requirements for paper shredders since the GDPR came into force, and fines have been imposed generously in the meantime.

Then it goes to the filing system. At this point there should be uniform rules. Does the company bicycle land under B or under L for leasing?