TL;DR
A clean desk policy exists to stop information being seen or taken by people who should not have it. The office wording is obsolete for a remote team, but the purpose is not. Rewrite it around what is visible and what is removable, and accept that you cannot inspect a home.
- Keep the purpose, discard the furniture.
- Five rules: screens, locking, printing, removable media, household exposure.
- Shared workspaces carry more exposure than homes and get mentioned least.
- Be honest that enforcement is partial, and back rules with technical controls.
- Home printing is the gap almost every policy leaves open.
- If devices are unaccounted for, the desk is not your biggest problem.
When you can skip this entirely
Four stages, and the first genuinely needs nothing.
Nothing sensitive. If nobody handles personal or customer data, the rule protects little. Write it when there is something to protect.
Best tools for HR Operations
Everyone fully remote and alone. People working alone at home face a narrower risk. A line in the handbook about screen locking is proportionate.
Shared spaces appear. Coworking, cafes, households with other adults. Now there is an audience and the policy earns its place.
Somebody asks. A customer questionnaire or an insurer wants to see it. At this point it has to exist, be current, and be plausible for how you actually work.
What a clean desk policy was actually protecting
Strip the furniture out and the original rule addressed three things. Information visible to passers-by. Information removable by somebody walking past. And information left behind when a person moved desks or left.
All three survive remote work. A screen is visible to a flatmate, a partner or the next table. A printed page is removable by anybody in the household. And information left behind is now a laptop in a spare room rather than a drawer somebody can open.
That third one is the interesting shift. In an office, leaving meant walking out past a security desk and leaving your equipment behind. Remote, the normal state at the end of employment is that somebody keeps holding everything until a process reaches them.
There is a second shift worth naming. In an office, the people who might see a screen were colleagues bound by the same contract. At home or in a cafe they are not, and that changes the nature of the exposure rather than only its likelihood. A flatmate reading a customer name over somebody’s shoulder is outside every agreement your organisation holds.
Guidance from national bodies has caught up with this more quickly than most internal handbooks. The National Institute of Standards and Technology publishes practical material on securing remote and home working setups that is a better starting point than an office-era template, and it is written for people who are not security specialists.
So the modern version of a clean desk policy is mostly about devices. The paper rules are a small corner of it. If your policy is still ninety per cent about paper, it is protecting the smallest part of the risk and reads as if nobody has updated it since the office closed. Control expectations under ISO/IEC 27001 are framed around protecting information and associated assets rather than tidiness, which is the framing worth borrowing.
The five rules that survive remote work
- Screens in shared spaces. Position so others cannot read them, and treat coworking and cafes as public. A privacy filter is a reasonable thing to supply rather than request.
- Lock when you step away. Short, universal, and the single most useful rule in the document. Enforce it technically with a short timeout rather than relying on habit.
- Printing. Discourage printing anything sensitive at home. If it happens, say how it is stored and how it is destroyed. Most policies are silent here, which means the default is a recycling bin.
- Removable media. Say whether USB storage is permitted at all. If not, say so plainly rather than implying it through a different document.
- Household and visitors. Equipment should not be used by other members of the household. Obvious to write, genuinely not obvious to everybody, particularly where a laptop is the best machine in the house.
Five questions before you publish it
Could somebody follow this in a one-bedroom flat? If not, it is an office policy wearing new words.
Have you mentioned coworking explicitly? It is the highest-exposure setting and the one most often unaddressed.
Is any of it technically enforced? Screen timeout and disk encryption do more than any sentence.
What happens to printed material? If you have no answer, either prohibit printing or supply a route.
Does it connect to your equipment policy? The two overlap, and contradicting yourself across documents is worse than a gap.
How teams handle it, and the trade-offs
Keeping the old office policy. Best for having something on file. It struggles on credibility, because a document telling remote staff to clear their desk at close of business teaches people that policies are decorative.
Deleting it. Best for honesty, and defensible if nothing sensitive exists. It struggles when a questionnaire asks, and the absence is harder to explain than a short policy would have been.
Folding it into the acceptable use policy. Best for most remote teams, because it keeps related rules in one place people already read. It struggles if a reviewer specifically asks for a named clean desk policy, though pointing at the section usually satisfies that.
Technical controls instead of wording. Best for the rules that can be enforced: timeouts, encryption, blocking removable media. It struggles because it cannot address paper or household use, which still need stating.
Equipment accountability as the foundation. Disclosure: RemoAsset is owned by the same people who publish this site. It handles issue, tracking, retrieval and wiping across 80 or more countries, which matters because the modern version of this policy is largely about devices. Where it struggles: it has nothing to say about screens, printing or household behaviour, which remain policy and culture questions. It addresses one specific part, which is whether equipment actually comes back.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| Nothing sensitive handled | Any | Any | None | Skip it, revisit when data changes |
| Fully remote, people alone | Under 50 | No HR function | Minimal exposure | One clause in acceptable use |
| Coworking common | Any | Any | Screens in public | Name shared spaces, supply filters |
| Office policy still live | Any | HR owner | Document is obsolete | Rewrite around visibility, not desks |
| Customer questionnaires | 50 plus | Compliance owner | Must produce a policy | Short, remote-credible version |
| Devices unaccounted for | Any | Any | Bigger risk unmanaged | Fix equipment tracking first |
What the wrong version costs
An obsolete clean desk policy rarely causes an incident. It causes something slower and more corrosive: it teaches people your policies are not meant literally.
Somebody reads a rule about clearing their desk at close of business, looks at the kitchen table they work on, and concludes the handbook describes a company they do not work for. That conclusion does not stay in one document. It travels to the clauses that genuinely matter.
The second cost appears in reviews. A reviewer reading a policy clearly written for an office learns that your documentation has not kept up, and starts testing other claims. One obviously stale page changes how the rest is read.
The third is misdirected effort. Writing careful rules about paper while laptops sit unaccounted for with former employees is attention spent on the smaller exposure. The desk was never the main risk once the desk stopped existing.
So the question is not whether you have a clean desk policy. It is whether anybody reading it would recognise their own working day in it.
When the real exposure is the device, not the desk
There is a point where tidying the policy is the wrong task because the exposure has moved. It is recognisable from one question: how many company laptops are currently with people who no longer work here?
If that number is unknown or uncomfortable, the clean desk policy is addressing a minor risk while a larger one sits unmanaged. No rule about screen positioning matters as much as a machine nobody can reach.
The sequence that works is to fix accountability first, then write the behavioural rules. Know which device is with whom, have a route to recover it, and record what happened. Then a short policy about screens, printing and household use makes sense, because it sits on top of something solid.
Done the other way round you get a well-written document about furniture and an unmanaged fleet. If the device question is the uncomfortable one, seeing how tracking and recovery work together is the more useful place to start.
See how equipment accountability works for remote teams
Read our guide to remote work equipment
Related reading
- Remote work equipment, practically
- Putting device policy in the handbook
- Writing an employee equipment policy
- BYOD policy, practically
- Equipment for constant travellers
Frequently Asked Questions
What is a clean desk policy for?
Stopping information being visible or removable by people who should not see it. In an office that meant locking papers away and clearing screens. The purpose survives remote work even though the original wording does not, which is why rewriting beats deleting.
Does it still make sense if nobody has a desk?
The rule does not, the purpose does. A kitchen table in a shared flat has the same exposure a hot desk had, often more. Rewrite the policy around what is visible and what is removable rather than around furniture nobody has.
What should the remote version cover?
Screen privacy in shared spaces, locking when stepping away, where printed material goes, how removable media is handled, and what happens to equipment in a household with other people. Five short rules, each of which somebody could actually follow.
Is this enforceable in someone’s home?
Partly, and being honest about that matters. You can require screen locking and set rules about printing and storage. You cannot inspect a home. Write what you can reasonably expect and support it with technical controls rather than pretending to supervise.
What about printed documents?
The simplest approach is to discourage home printing of anything sensitive and say so plainly. If people must print, state how it should be stored and destroyed. Home printing is the part of remote work that most policies ignore completely.
Does this apply to shared workspaces?
More than anywhere else. A coworking space has the exposure of an office with none of the controls, and people treat it as private because they are paying for it. Name shared spaces explicitly rather than assuming home and office rules cover them.
How does this connect to equipment?
Directly. A policy about what is visible and removable is a policy about devices, which are the most removable things people hold. If equipment is unaccounted for, the clean desk rule is addressing the small risk while the larger one is unmanaged.
