clean desk policy (CDP)
What is a clean desk policy (CDP)?
A clean desk policy (CDP) is a corporate directive that specifies how employees should leave their work space when they leave the office. Most CDPs require employees to clear their desks of all papers at the end of the day. In the past, implementation of a clean desk policy was at the discretion of the management.
Today, CDPs are primarily used to ensure important papers are not left out and to conform to data security regulations. They also enable a business to present a clean, professional image to customers, clients and other visitors.
Workers commonly handle sensitive information throughout the day. The information might be on paper or be in an electronic format. Implementing a CDP helps protect this information and adhere to an organization's security and privacy policies.
A CDP specifies how workers should leave their desks or workstations when they step away, whether to take a break or to go home at the end of the workday. It stipulates how workers should treat paper items, such as Post-it notes, printouts, paper scraps or any other printed material.
These policies may include how to handle electronic devices, including desktops, laptops, tablets, USB drives and external storage devices. A CDP might also address the use of physical storage, such as closets, lockable storage drawers and file cabinets, as well as the keys that lock them.
Why are clean desk policies used?
Organizations have CDPs for many reasons. In the past, they were used to keep their offices free of clutter and present outsiders with an impression of professionalism and competence.
Today, CDPs help limit the exposure of sensitive data to unauthorized individuals, such as cleaning staff or outside vendors, and avoid security breaches. Businesses use CDPs to ensure conformance to information security (infosec) compliance regulations. The following are some examples of these types of regulations:
- International Organization for Standardization 27001;
- General Data Protection Regulation;
- California Consumer Privacy Act; and
- Health Insurance Portability and Accountability Act.
Clean desk policies also support new ways of working in offices where fewer employees have dedicated offices and desks. Instead, organizations use approaches such as desk sharing, hot desking, hoteling and hybrid remote work, where workers may be assigned to sit at any desk in the office space or they may share a common desk with other employees and only come in on assigned days.
Among the benefits of a clean desk policy are that it supports efforts to replace hard-copy paper documents, particularly sensitive documents, with digital documents by discouraging the use of paper printouts.
How do you implement a CDP strategy?
An effective CDP strategy should include the following:
- Clarity. The CDP should be in writing with clear instructions about what is expected of workers and what actions they must take.
- Availability. It should be distributed to all workers, including new hires and temporary contractors, and be easily accessible to everyone affected by the policy.
- Electronic documents. Workers should be encouraged to use electronic documentation whenever possible. For this to work, however, IT must ensure that all data is being backed up and adequately protected.
- Reminders. Processes should be put into place to regularly remind workers about the policy. This might include putting up posters, adding notes to email signatures and incorporating CDP information into employee training programs.
- Tools. Workers should be provided with easy access to the tools they need to conform to the CDP, such as paper shredders, lockable file cabinets and other secure places to store their items.
- Management support. Senior management must be onboard with the effort and should lead the way through example, adhering to the same policies as everyone else.
- Enforcement. One or more individuals should be assigned the responsibility of enforcing the CDP and provided with the latitude and resources to ensure the CDP and related security policies are adhered to.
In general, the CDP should outline what is expected of workers, what is expected of management, who is responsible for monitoring the success of the policy, how monitoring will be done and what the consequences will be for policy noncompliance.
Typically, workers are responsible for clearing their desks, securing their electronic devices, and locking up drawers and cabinets before they leave the office. Management is responsible for providing access to the tools that workers need to secure their work environment, such as paper shredders and storage spaces.
An office manager or infosec team member might be tasked with checking the office at the end of the day to verify CDP compliance and confiscate printed material or portable devices left out. Consequences for noncompliance could be anything from a verbal warning to termination from the company, according to the CDP's specifications.
CDP's challenges
There are some specific challenges associated with CDPs, including the following.
Remote work
One challenge associated with CDP is how to enforce it with remote workers who are working from home or public places, such as coffee shops. It is important to emphasize to employees that the policy applies wherever they are working.
Visual controls
A CDP can hamper the work of employees who use visual controls to do their jobs. The term visual control grew out of Lean production techniques. It means that certain information, which can include proprietary data and confidential information, is displayed in full view of everyone in a workgroup.
A visual control might be something that is complex, is large or has many components and isn't easily stored at the end of the day. For example, some groups use large Agile programming Scrum charts to track progress. In such cases, it might still be possible to implement a CDP. Workers can share a secure work area and take responsibility for cleaning it -- e.g., vacuuming, dusting or taking out the trash.
Learn how to build a paperless office with these strategies.