Clear desk/clear screen

Check desks/working areas are clear of any documentation or removable media that may contain restricted information and are all screens locked when unattended?

Devices should be logged-off in-line with relevant policies/SOPs.

NOTE: DO NOT confuse clear-desk and tidy-desk.

Shared devices

If shared devices, i.e. desktop computers, are in use, e.g. in lecture/meeting rooms, check local storage, i.e. the local hard-drive, is cleared after each session or at cease-work or periodically; whichever is appropriate. Where restricted information is discovered, escalate to IGO.

Access points

Check uncontrolled doors and ground-floor windows are secured when necessary, i.e. when workspaces are unoccupied or at the end of the working day.

Printers/fax machines

Check that printing has not been left on printer trays. If it has, and it appears to contain restricted information, escalate accordingly.

Paper waste

Paper waste containing restricted information and electronic media is to be disposed of in-line with the relevant policy.

Check waste paper consoles are not overflowing. Check paper waste is not stacked beside consoles. Paper waste pending disposal is to be secured under lock and key until it can be properly disposed of.

Removable media

Removable media, i.e. USB devices (flash drives, external hard disk-drives, etc.) should be secured under lock and key when not in use.

Check workspaces for unsecured items.

Noticeboards/whiteboards

Ensure whiteboards/noticeboards in meeting rooms, communal or public areas are clear of any restricted information or personal data. Preferably, they are to be cleared after all use, especially at the end of a working day.

Where restricted information cannot be cleared, they should be secured in a locked room.

Laptops left in-situ

Laptops or other portable hardware should be secured when not in use.

Check for laptops that have been left in offices/workspaces overnight. Laptops left in-situ are to be kept under lock and key, i.e. in a locked desk drawer or cupboard/cabinet. Kensington locks may be used (on docks or devices) if they are secured solidly, but docking stations are not secure even when locked as they can be easily disconnected and removed.

Filing cabinets/desk drawers

Check contents of all unlocked drawers/cupboards/cabinets, etc. Any restricted information found is to be reported accordingly.

Loose hard-copies

Unattended loose documents containing restricted information should be stored securely. If discovered during a check, loose papers should be secured as best as possible at the time and ownership determined where possible.

ID cards

This should be considered as guidance rather than an action, but the general principle should be encouraged in the workplace.

Staff should at least carry ID cards on their person and be prepared produce them when required/on demand.  Ideally they should be worn visibly at all times when on UoM premises (especially in access-controlled or other restricted areas) as this will reduce the possibility of being challenged.  Staff should be made aware that spot-checks may be carried out.

ID cards that are found (and clearly appear to have been lost) should be handed to security.

Restricted areas

Check all access points to restricted areas are secure.  Are there any restricted areas?  If so, are they subject to access restrictions such as the following:

• Access lists (role based access); 2-man principle/no lone zone, i.e. are escorts required; log reviews/CCTV
• Are access lists reviewed periodically?
• Are access logs checked?
• Is an approved process followed to allow access to restricted areas
• Beware of tailgating into secure areas.

Visible passwords

i.e. WiFi, logins, etc.

Check for log-in credentials that have been written in notebooks, on sticky notes, etc.  These can commonly be found under keyboards, on desktop monitors, on desk-planners, etc.

Is the password policy being followed to the best of your knowledge?