Clean Desk Guidlines

1. Overview

A strong, sustained security culture requires that all employees adopt best practices as part of their day-to-day activities to protect the information and assets entrusted to them regardless of their location of work. One of these best practices includes continuously applying the "Clean Desk" principle to prevent the unauthorized disclosure of sensitive information and the loss of departmental assets.

2. Purpose

The Clean Desk Guidelines provide a quick reference to clarify responsibilities and help employees ensure that departmental sensitive information, documents and assets are properly stored and safeguarded when employees are away from their workstation or remote work environment. Following these guidelines will help reduce the risk of security incidents involving departmental information and assets and will help sustain a strong security culture at ESDC. The guidelines are also meant to assist in increasing employees' security awareness on protecting sensitive information and departmental assets both in the office and remotely.

The guidelines are divided up by work environment to ensure that all different work environments are described and that employees are adequately informed on how to be security smart and compliant in the environment they work from.

3. Scope

These Guidelines apply to all employees (including indeterminate, determinate, casuals, contractors, and students) who:

Use space in Employment and Social Development Canada (ESDC) locations (e.g. General office spaces, Service Canada Centers and Processing/Call Centers);
Handle departmental information; and
Work with departmental assets (in any work location either in the office or remotely).

4. Considerations

These Guidelines are evergreen and reflect the work reality of ESDC employees and the required behaviors to adapt to ensure that maximum efforts are made to keep ESDC's information and assets secure in all work environments:

Assigned Office (e.g. Duty to Accommodate): Working from an assigned desk, on the premise of ESDC locations, including Service Canada Centers.
Unassigned Office (Shared Seating): Working on the premise of ESDC locations from an office space that was reserved for a specific period of time.
Mobile Office: Working in a public space that is not normally used for work, such as when an employee is working on public transit, in an airport, a hotel room, or a café. Mobile work always requires, at a minimum, the approval of your manager.
Home Office: Includes both telework (flexible work arrangement in the Directive on Telework issued by TBS) and remote work (work arrangement whereby the employer has requested the employee to carry out some or all of their work duties away from the designated workplace)

These Guidelines should be followed in along with the requirements of the Enhanced Clean Desk Guidelines and the security measures highlighted in the Information Categorization Tool.

5. Guidelines

ESDC employees are able to request various work locations. Regardless of the environment, maintaining the security of ESDC's information and assets is paramount and additional measures may be required for those working remotely.

There are four (4) work locations outlined in these guidelines. Please refer to the one that represents the environment you work in.

6. Foreign Teleworking

The decision to allow Foreign Telework is at the discretion of the Executive Workforce Management Committee (EXWMC) after considering the risks. The review process includes a consultation with Security, Labour Relations and Occupational Health and Safety in the overall assessment of the request.

All foreign telework agreements must be pre-approved prior to the travel date and start of any telework activities. Employees and managers must follow the Foreign Telework Procedure.

7. Compliance

Corporate Security is currently reviewing ESDC'S mechanisms to ensure compliance to these guidelines in a remote working, teleworking or mobile working environment.

Compliance to these guidelines in an assigned work environment is verified through security inspections after core working hours when employees are away from the workplace.

In accordance with the ESDC Code of Practice, Managers are also responsible for:

Ensuring their employees apply sound security practices, including the Clean Desk Guidelines.
Reporting the loss or theft of ESDC information or asset using the Security incident reporting process.

8. Useful Reference Material

The following reference material can be used to help you protect ESDC information and assets:

9. Exempted Work Areas

Given the operational environment and the nature of the work for some ESDC Programs, application of these Guidelines may not be possible in certain areas due to the large quantity of sensitive information processed on a daily basis. Some examples include:

Operations Centres
Production Areas
Processing Centres (Passports)
Mail Rooms
File Rooms with workstations

As the Clean Desk Guidelines are not operationally feasible in these areas, Minimum Security Requirements (Section 10) are required to ensure the protection of sensitive information.

As part of the oversight role, the Chief Security Officer (CSO) must assess the type of information and security measures in place in areas requesting exemptions to the Guidelines to ensure these meet the Minimum Security Requirements and approve the security measures in place in these areas.

A Request for Exemption to the Clean Desk Guidelines (PDF, 495 KB) (opens new window) must be completed and sent to the exempt location's Regional Security Office who will review and validate the information and forward the request to the CSO.

The CSO will then review the request for exemption and approve or refuse (with comments) a location as being exempt from the application of the Clean Desk Guidelines.

10. Minimum Security Requirement for Exempted Work Areas

At a minimum, the following security requirements must be in place in all areas exempt from the Clean Desk Guidelines:

Access Card control systems and restricted access; and
Intrusion Alarm System monitored during silent hours.

ESDC Clean Desk Guidelines: Securing your work environment