papers or storage media shall be locked away when not required as well as a clear screen policy such as session time-out or automatic lock screen, to ensure that sensitive or critical information shall not