Clean Desk Policy: The Low-Tech Control That Closes Real Gaps
A clean desk policy requires that workspaces be cleared of sensitive material whenever they are unattended. Papers go in locked storage, screens are locked, whiteboards are erased, removable media is put away. It sounds like housekeeping, and it is routinely dismissed as such — which is exactly why it appears on the Security+ exam as an administrative control with a physical effect . What it is protecting against The threats are unglamorous and common. Shoulder surfing needs nothing more than a visitor glancing at a monitor or a printout while walking past. Casual data collection by anyone with routine building access — cleaning staff, contractors, delivery personnel, a candidate waiting in a conference room — requires no skill at all when the material is lying face up. Credentials on sticky notes remain a real finding in real assessments. So do printed reports left in output trays, notepads with system names and IP addresses, and whiteboards holding an architectur...