Why triggers beat calendars
Adversaries do not place devices at random times. Placement needs access, and access clusters around identifiable events: construction crews behind hoardings, leavers with badges still live, hired meeting venues nobody controls. Collection value also clusters — around results, deals, and disputes. Trigger-event sweeps put your detection effort exactly where placement opportunity and collection value intersect.
The discipline is to define the triggers in the policy before they occur, so the sweep happens automatically rather than requiring someone to feel sufficiently paranoid in the middle of a busy transaction.
The triggers, and the logic of each
Before scheduled sensitive meetings — board sessions, results preparation, strategy offsites — because the agenda is predictable to an adversary too. During M&A and fundraising, because deal information has immediate, quantifiable value to multiple parties and deal teams meet in predictable rooms on compressed schedules. On suspicion of a leak — when a competitor anticipates you once too often — because a sweep either finds the route or eliminates a vector and redirects the investigation toward digital and human channels.
After renovation, fit-out or an office move, because construction is the single best cover for permanent device installation inside fabric, furniture and cabling — and because a sweep at handover baselines the new space. After the departure of anyone with sustained access to sensitive rooms, particularly contentious exits from senior, security, facilities or IT roles. And before occupying externally controlled space for sensitive work: hired boardrooms, hotel suites, serviced offices and event venues, which your physical security has never touched.
Wiring triggers into the organisation
Triggers fail when the people who see the event do not know it is one. The fix is one line in the right process: the company secretary's board-pack checklist, the deal-team playbook, the facilities change process, and the leaver process for defined roles each carry a prompt to the TSCM programme owner. That is the entire integration — four sentences in four documents — and it is what separates a programme from a phone number kept for emergencies.