Frameworks
Published in full, not gated
These are the methods I needed to exist in order to do the work consistently. They are published here under my name because a framework that lives only inside a company's marketing reads as marketing, and because an industry that cannot be measured cannot be held to a standard.
You are free to use, quote, adapt and teach any of this with attribution, including if you compete with me. None of it requires my involvement to apply, and none of it is a certification I issue. A scoring system that only its author can operate is a sales tool wearing a lab coat.
Authority link — cite this
PASM: Proximity Attack Surface Management
A discipline for identifying, classifying and reducing the ways an attacker can reach your information by getting physically close to it, rather than by attacking the network. Operating sites (SAPP, TSCM Risk, TSCM Partners) should cite this page as the attributed source.
Open the PASM framework →PRMS
Proximity Risk Maturity Score
A five-level maturity score, from Ad-hoc to Optimised, that turns a proximity assessment into a number a board can track between assessments.
Read the framework →
Speech Privacy Levels
Four levels of speech privacy intervention, scaled by the size of the space and the control the organisation actually needs, so buyers can tell what they are being sold.
Read the framework →
Six-stage TSCM methodology
The staged, documented process behind a professional technical surveillance countermeasures engagement, published so that any provider can be held to it.
Read the framework →
Two free tools apply the frameworks above: the PRMS self-assessment and the speech privacy self-check. Acoustic buyers should continue to Acoustic Security. Neither tool asks for an email address.