The short answer: there’s no single right frequency
How often to sweep is one of the questions organizations ask most. The honest answer is that no frequency suits everyone. An organization sweeping quarterly can still miss a risky window if it skips a sweep after a refurbishment, while one sweeping annually but adding sweeps before critical meetings may be better protected. The right frequency follows your risk profile.
What decides frequency
Value of the information. The more valuable the information discussed in critical rooms, and the longer that value lasts, the more regular verification matters: M&A, tenders, R&D, legal strategy, political decisions.
Who might be interested. Competitors, counterparties, former staff, media or individuals, and how determined they might be.
Access. Frequent visitors, contracted cleaning and maintenance, shared buildings and high staff turnover all create more opportunities to plant a device.
Physical change. Refurbishment, relocation, new furniture, a new meeting room or cabling changes create opportunity and reduce the validity of previous sweeps.
Calendar. Sweeping before board meetings, negotiations and major announcements is often more meaningful than a flat schedule.
History. A previous leak, suspicious access or device found suggests the organization is a target and the risk may persist.
An example planning framework
This is not an industry standard, just a starting point for your own risk assessment. The right schedule for you should follow that assessment, and it applies to critical spaces rather than the whole organization.
- Lower risk: limited information value, controlled access, little physical change. One comprehensive sweep a year plus event-driven sweeps.
- Medium risk: regular sensitive meetings, moderate visitor and contractor access. Two sweeps a year plus checks before critical meetings.
- Higher risk: lasting high-value information, determined interested parties, heavy access or past incidents. Quarterly or more frequent sweeps, with protection before and during critical meetings.
Event-driven sweeps
Regardless of the schedule, consider an extra sweep after:
- Refurbishment, relocation or a new meeting room
- Before a critical board meeting, negotiation or announcement
- The departure of someone in a sensitive role, especially a contentious one
- Suspicious access, an unexplained maintenance visit or a suspected leak
- New electronics, furniture or gifts entering critical rooms
Keep it unpredictable
As important as frequency is unpredictability. A sweep held the same week every year, or announced in advance, makes it easy to remove a device on the day and replace it later. Avoid fixed patterns, share dates with the programme owner and access contact only, and use neutral calendar entries.
Prioritise critical spaces
Trying to sweep the whole building equally spreads resources thin. Identify critical spaces first: the boardroom, executive offices, legal and finance meeting rooms, R&D areas, executive homes and vehicles. Sweep those more often and general areas less.
Between sweeps
A sweep verifies a moment. Administrative measures protect the time between: logging access to critical rooms, checking gifts, a phone policy for sensitive meetings, recording refurbishment and cabling changes. They also make changes easier to spot next time.
Common mistakes
- Thinking about sweeps only after a leak
- Announcing sweeps or making them predictable
- Leaving critical rooms uncontrolled after a sweep
- Relying on a single method, such as an RF detector alone
- Never reviewing the programme against findings and changing risks
The right frequency comes from knowing your organization and assessing its risks together. Our corporate periodic TSCM programme starts with that assessment and proposes a schedule with the reasoning behind it.