1.1 Clean Desk Guideline

1.1.1. Overview

A clean desk can be an import tool to ensure that all sensitive/confidential materials are removed from an end user workspace and locked away when the items are not in use or an employee leaves his/her workstation. It is one of the top strategies to utilize when trying to reduce the risk of security breaches in the workplace. Such a standard can also increase employee’s awareness about protecting sensitive information.

1.1.2. Purpose

The purpose for this guideline is to establish the minimum requirements for maintaining a “clean desk” – where sensitive/critical information about our employees, our intellectual property, our customers and our vendors is secure in locked areas and out of site. A Clean Desk guideline is not only ISO 27001/17799 compliant, but it is also part of standard basic privacy controls.

1.1.3. Scope

This guideline applies to all Highline College employees and affiliates.

1.1.4. Guideline

1.14.1

Employees should ensure that all sensitive/confidential information in hardcopy or electronic form is secure in their work area at the end of the day and when they are expected to be gone for an extended period.

1.1.4.2

Computer workstations should be locked when workspace is unoccupied and at the end of the workday.

1.1.4.3

Any Restricted or Sensitive information should be removed from the desk and locked in a drawer when the desk is unoccupied and at the end of the work day.

1.1.4.4

File cabinets containing Restricted or Sensitive information should be kept closed and locked when not in use or when not attended.

1.1.4.5

Keys used for access to Restricted or Sensitive information should not be left at an unattended desk.

1.1.4.6

Laptops should be either locked with a locking cable or locked away in a drawer when unattended and at the end of the work day.

1.1.4.7

Passwords must not be left on sticky notes posted on or under a computer, nor may they be left written down in an accessible location per the Password Protection Standard.

1.1.4.8

Printouts containing Restricted or Sensitive information should be immediately removed from the printer.

1.1.4.9

Upon disposal Restricted and/or Sensitive documents should be shredded in the official shredder bins or placed in the lock confidential disposal bins.

1.1.4.10

Whiteboards containing Restricted and/or Sensitive information should be erased.

1.1.4.11

Treat mass storage devices such as CDROM, DVD or USB drives as sensitive and secure them in a locked drawer. All printers and fax machines should be cleared of papers as soon as they are printed; this helps ensure that sensitive documents are not left in printer trays for the wrong person to pick up.

1.1.5. Related Standards, Policies, and Processes

1.12 Password Protection Policy

4.2 Encryption Standard

1.1.6. Revision History