What PASM adds to a TSCM programme
Most organisations already run mature digital controls and still leave spoken and near-field information under-specified: boardrooms, executive suites, deal rooms, travel and event spaces. PASM names that proximity and physical-technical attack surface so it can be assessed, owned and treated like any other information-security risk — with TSCM as the operational verification control inside the programme.
This page does not restate the full PASM framework. It shows where the framing plugs into artefacts you already maintain: the enterprise risk register, principal-risk reporting, and the ISMS. Full framework detail lives with the authors linked below.
Map PASM into the risk register and principal risks
Write proximity / technical surveillance as an owned register entry: threat sources, vulnerability (predictable rooms, third-party access, standing microphones, no detection), impact tied to named information classes, and a treatment that points at a scoped TSCM programme. Where board-level confidentiality or deal leakage would be material, elevate the same risk into principal-risk language so Risk and Audit see coverage, exceptions and residual exposure in the same pack as cyber and operational risk.
Cadence and trigger events then become the residual-risk statement in practice: the accepted window between inspections is what the committee is asked to endorse. Link the entry to your TSCM policy and to board-reporting lines so the control is visible without operational theatre.
Place it in the ISMS — without inventing a parallel system
Under ISO/IEC 27001, proximity risk belongs in clause 6.1.2 risk assessment and in Annex A section 7 physical controls as effectiveness verification: periodic TSCM inspection tests whether secure areas actually kept unauthorised equipment out. Under NIST SP 800-53, RA-6 supplies the federal vocabulary for defined locations, frequency and events. NIS2's all-hazards physical-environment language and UK governance expectations for material controls sit on the same spine.
The practical outcome is a group-wide programme: one methodology, clear ownership, centralised vendor oversight where spend is fragmented today, and dated evidence packs internal audit can reuse. Assess, govern, verify — with PASM as the risk language and TSCM as the control that proves it.