MarkoTuiskContact
Governance5 min read

The proximity gap in a cyber-mature ISMS

Most information security programmes speak fluently about digital controls and almost not at all about collection that happens in the room. That is a maturity gap, not a niche specialty.

If you sit on a Risk or Audit Committee, you already recognise the language of a mature information security programme: risk appetite, principal risks, ISO/IEC 27001, NIST control families, third-party cyber risk, access management, continual improvement. Those programmes are usually strong where the attacker is assumed to be remote.

They are usually thin where the attacker is close. Boardrooms, executive suites, R&D floors, deal rooms, and travel itineraries concentrate information that never touches a ticketed vulnerability scanner. Someone who photographs a screen, leaves a recorder, or listens through a wall does not need to defeat your perimeter. Your ISMS may not even enumerate that surface.

What the gap looks like in practice

  • Digital controls are owned, measured, and reported. Proximity and physical-technical collection are episodic — often a local sweep after a scare.
  • Internal audit can reuse cyber evidence packs. Sweep reports, when they exist, are vendor PDFs that do not map to control effectiveness language.
  • Procurement buys many local providers. Quality and method vary by city; the committee cannot compare sites.
  • Speech privacy and acoustic leakage sit outside both cyber and facilities ownership, so nobody budgets for them until a conversation is overheard.

That pattern is why I published Proximity Attack Surface Management (PASM): so the proximity surface can be enumerated, scored, and reduced in the same vocabulary the committee already uses — without pretending a one-off bug sweep is an ISMS control.

What to do with the gap

Treat proximity as a control domain with an owner, a method, and a reporting cadence. Use an independent TSCM audit when you need dated control-effectiveness evidence for scoped spaces. Use a standing programme when you need policy, frequency, and multi-site consistency. Use operational proximity threat management when protective and sensitive environments need day-to-day application rather than a paper framework alone.

A cyber-mature ISMS that ignores the room is not mature. It is half a programme with a confident dashboard.

Written by Marko Tuisk, director of TSCM Partners Ltd (company 16842743).

More writing