Cyber security protects information within digital systems. PISA considers what happens when information moves into the physical environment and becomes accessible to people.

PISA considers how information may be exposed, obtained, communicated or introduced, and the physical, technical and human conditions that may allow this to occur.

The purpose is assurance

People responsible for information of value need reasonable assurance that the environments in which it is used are appropriate for that purpose.

PISA brings physical, technical and human considerations together to identify vulnerabilities, maintain appropriate controls and provide independent examination where required.

It is preventative by design: identifying conditions that could result in the unauthorised exposure, acquisition or introduction of information before they result in compromise or unfair advantage.

Making assurance normal

PISA is not simply a response to suspected surveillance or a requirement for a one-off Technical Surveillance Countermeasures (TSCM) sweep.

It provides a framework through which physical information security can become part of normal organisational practice.

Routine controls can be maintained by the organisation itself, supported by periodic independent examination and specialist TSCM where appropriate.

The existence of assurance can be understood throughout the organisation without making its operational pattern predictable.

Assurance becomes normal. When, where and how examination takes place need not be.

PISA and TSCM

Technical Surveillance Countermeasures are an important component of physical information security assurance.

TSCM provides specialist examination for technical surveillance, associated vulnerabilities and conditions that may affect the integrity or confidentiality of an environment.

PISA places that specialist capability within a wider and continuing assurance process rather than treating the examination as an isolated event.

Competitive environments and fair play

Information and communication can also have value in competitive environments. Unauthorised communication, access to information or external assistance may create an unfair advantage.

PISA can be applied to live competitive environments to identify vulnerabilities and provide independent assurance over the physical and technical conditions in which competition takes place.

This can support existing competition rules, fair play measures and event security. PISA does not determine whether a breach of rules has occurred; it provides assurance over the environment in which fair competition is expected to take place.

Supporting existing information security

PISA is intended to complement, not replace, an organisation’s existing information security, physical security, risk management and governance arrangements.

It provides a practical means of considering information risk where information moves beyond protected digital systems and into the physical environment.

PISA does not itself constitute certification or demonstrate compliance with a particular standard or legal requirement. It can, however, provide evidence of the measures taken to understand and manage physical information security risk.

Whiterock

Whiterock developed PISA from more than three decades of practical experience in Technical Surveillance Countermeasures and physical information security.

The approach reflects a simple principle:

Information of value requires protection wherever it is used.

Read the Whiterock White Papers for further examination of PISA, TSCM and physical information security.