RA-6 Technical Surveillance Countermeasures Survey is a niche control. It asks you to employ a technical surveillance countermeasures survey at locations or events you define. NIST 800-53 binds US federal systems, and others by contract. Most private companies will not need it.
What it means in practice
The guidance describes the survey as a service from qualified personnel that detects technical surveillance devices and hazards and finds security weaknesses that could allow a technical penetration of a facility. It includes visual, electronic and physical examination, inside and out. It also feeds risk assessments.
If you handle highly sensitive information in a controlled facility, or your contract requires it, this is the control. Otherwise record it as not applicable, with a reason, such as no facilities with that requirement.
Evidence to collect
- If applicable, the survey report, date, provider and follow up actions.
- If not, the scope decision and who approved it.
Common gaps
- No decision recorded either way.
- Findings from a survey are not tracked to closure.
How to implement it
Decide which locations, if any, warrant a survey, based on your risk assessment and contracts. Hire qualified providers. Track findings as you would any risk.
Quick check
Should a small software company run a TSCM survey?
Usually not. Document why the control is out of scope, and revisit it if a contract or a facility changes.
