Clean Desk Policy

A clean desk policy is a workplace security rule requiring employees to clear sensitive material from their workspace whenever they leave it: documents locked away, notes shredded rather than binned, screens locked, and whiteboards wiped at the end of a meeting. It is one of the oldest controls in information security — and one of the few that defends against attacks no firewall will ever see, because the data leaks on paper, in plain sight.

How it works

The policy closes a set of quiet, physical exposure paths. A visitor walking to a meeting room passes desks stacked with customer printouts. A contractor photographs a whiteboard that still carries last quarter's revenue figures and the admin password for the demo environment. A tailgating intruder needs only an unattended desk with a password on a sticky note. Shoulder surfing and dumpster diving — reading over a shoulder, retrieving documents from the trash — both depend on sensitive material being physically available, and a clean desk policy is precisely what removes it. Hybrid work widened the attack surface: the kitchen table, the café, and the co-working space are all desks now, with none of the office's physical controls around them.

Typical requirements: lock documents and removable media away when leaving the desk; shred rather than discard; lock the screen on walking away (enforced by a short auto-lock timeout); clear whiteboards and collect printouts immediately; and keep nothing confidential visible on camera during video calls.

How to defend against it

Treat the policy as a habit to build, not a memo to file. Write it into the acceptable use policy, make compliance effortless — lockable storage at every desk, shredders and secure-disposal bins within reach, print-release at the printer — and reinforce it with walkthroughs that leave a friendly note rather than a reprimand. Include physical scenarios in your security training and simulations: our guide to the physical side of social engineering shows how attackers chain an open door, an unattended desk, and a confident smile into a breach that never touches the network.