What a cleaner is exposed to
Cleaning happens after hours in an empty building, which means documents on desks, whiteboards left unwiped, screens still logged in and printouts in trays. None of that is the cleaner's fault or their business, but it is present, and any sensible arrangement acknowledges it rather than pretending the risk does not exist because nobody has ever raised it and every organisation eventually finds an example of why it should have been.
The practical controls are shared. Your own clear-desk practice does most of the work, and no cleaning arrangement substitutes for it. What the provider contributes is confidentiality obligations, staff briefing, a rule about not moving or reading material, and a clear instruction about what to do with anything found on the floor or in a bin that plainly should not be there and whether they should mention it to anybody at all.
