Running a TSCM Programme
The difference between buying sweeps and controlling a risk is governance: a policy, an owned register entry, board-ready cadence, PASM mapping, defined triggers, and a line in the committee pack. Each guide below is usable as written.
Writing a TSCM Policy
A TSCM policy turns occasional bug sweeps into a governed control: defined spaces, defined cadence, defined triggers, and records that stand up to auditors, regulators and courts. Here is the full structure, usable as written.
→Technical Surveillance in the Risk Register
Most enterprise risk registers carry cyber intrusion in detail and say nothing about the interception of spoken information. Here is a complete, adaptable register entry: threat, vulnerability, impact, scoring, controls and owner.
→TSCM Cadence for the Risk Register and Board
Inspection cadence is a risk-register and board decision: how long an accepted exposure window sits between verifications, and how that rhythm appears in committee reporting. This guide sets programme cadence — distinct from general advice on how often to buy a one-off sweep.
→Proximity Attack Surface Management (PASM)
Proximity Attack Surface Management (PASM) is the framing that brings covert-device and near-field collection risk into the same language as your risk register, principal risks and ISMS — so technical surveillance is governed as a group-wide control, not an ad-hoc sweep.
→Trigger Events: When to Sweep Outside the Calendar
Most successful device placements exploit a moment: a fit-out, a departure, a deal. A calendar cadence alone misses them. These are the trigger events a serious programme defines in advance — and why each one earns its place.
→Reporting Surveillance Risk to the Board
Surveillance risk reaches most boards either as silence or as alarmism after an incident. Neither serves governance. Here is a reporting pattern that keeps the control visible, evidenced, and proportionate — in three lines a quarter.
→