Cybersecurity isn’t just about firewalls, passwords, or what the IT team does behind the scenes. It’s about what each of us does every day. And one of the most overlooked, yet most effective, habits we can build is keeping a clean desk.

That might sound simple. But in practice, it’s one of the easiest ways to reduce risk—and one of the most ignored.

What Is a Clean Desk Policy?

A clean desk policy is exactly what it sounds like: when you’re not at your desk, it should be clear of anything sensitive. That includes printed documents, notebooks, USB drives, sticky notes with passwords, and even your screen if you’re stepping away.

It’s not about being neat. It’s about being secure.

When desks are left cluttered, information is exposed. Anyone walking by—whether it’s a coworker, a visitor, or a contractor—can see what’s on your screen or in your files. That’s a problem.

Why It Matters

We’ve all seen it. A spreadsheet with client data left open. A password written on a sticky note. A USB drive plugged in and forgotten. These aren’t just bad habits. They’re security risks.

In some industries, this kind of exposure can lead to compliance violations. In others, it can lead to lost trust, lost business, or worse. But even if you’re not in a regulated space, the principle is the same: protect what matters.

A clean desk helps prevent data leaks, supports compliance, and shows we take our work seriously. It’s a small act that sends a big message.

What to Do Before You Leave Your Desk

• Lock your screen. Always.
• File away any printed documents.
• Remove USB drives and secure them.
• Don’t leave passwords written down—anywhere.
• Clear your whiteboard if it has sensitive notes.
• If you’re leaving for the day, double-check everything.

If you’re working remotely, apply the same rules at home. Just because you’re in your own space doesn’t mean you’re immune to risk. Family members, guests, or even delivery workers can see what’s on your desk.

What We’re Doing About It

We’ve already put strong technical controls in place—multi-factor authentication, conditional access, anti-phishing policies. But those tools only work if we do our part.

That’s why we’re reinforcing our clean desk policy across the board. It’s not about micromanaging. It’s about building habits that protect our clients, our data, and our reputation.

We’re also reviewing our internal policies and training. If you’re not sure what’s expected, ask. If you see something that doesn’t look right, speak up. Security is a shared responsibility.

A Personal Note

I’ve been guilty of this too. Years ago, I left a printed report on a shared desk during a site visit. It wasn’t critical, but it could’ve been. That moment stuck with me. It reminded me that security isn’t just IT’s job. It’s mine. It’s yours. It’s everyone’s.

We all have a role to play. And it starts with the basics.

Beyond the Desk

A clean desk policy is just one part of a bigger picture. Here are a few other habits that go hand-in-hand:

• Don’t reuse passwords. Use a password manager if needed.
• Don’t leave devices unattended in public places.
• Don’t click on suspicious links or attachments.
• Don’t assume someone else is handling it.

Cybersecurity is a mindset. It’s about being aware, being proactive, and being consistent.

Final Thought

A clean desk won’t stop every threat. But it’s a start. It’s a signal—to our clients, our partners, and each other—that we care about doing things right.

It’s easy to think cybersecurity is someone else’s job. But the truth is, it’s everyone’s job. And it starts with what’s right in front of us.

Let’s make it a habit.