October 2026. With hybrid work the office boundary has blurred, but the physical risks have not gone away: a laptop on the train, a screen on the kitchen table, a printer full of confidential papers. ISO 27001 covers this under 6.7 (remote working), 7.7 (clear desk and clear screen) and 7.9 (off-premises equipment). See also hybrid work and ISO 27001.
Clean desk and clear screen: short and concrete
Write three rules everyone can remember: lock the screen when you walk away, do not leave confidential papers unattended, and store or destroy confidential documents securely. A worked example is in our article on clean desk policy.
Home workplace and on the move
Set reasonable requirements for the home workplace: secured wifi, devices used only for work or with separate profiles, and privacy from onlookers, including housemates. On the move: privacy filter or screen angle, no confidential calls in public, and devices never unattended in the car. See also the remote work and BYOD policy.
Devices: encrypted and remotely wipeable
Full-disk encryption, a screen lock and the ability to wipe a lost device remotely together determine the risk on loss. Manage this through MDM and require immediate reporting of loss. An unencrypted device is, in practice, a data breach.
Paper and printing
Limit printing at home, provide a clear route for destruction (confidential waste) and decide what may be taken off-site. Often the simplest measure is: do not print what you do not need to.
Evidence an auditor will accept
The policy, the awareness material, an MDM report on encryption and screen lock, and an example of a reported loss. On a site visit the auditor also looks at practice: desks, screens and locked cabinets. More on physical measures at physical security.