How Often Should a Business Sweep for Bugs? What the Doctrine Actually Says

We read fourteen provider pages on this question, eight Indian and six overseas. They assert intervals ranging from once a year to four times a year per area, a spread of roughly twelve to one. Two of them contradict each other outright, one arguing that an annual cadence leaves too long a gap and another calling annual a sound baseline. Across roughly twenty two thousand words, not one cites a standard, a regulator, a statute, a study or a government instruction in support of any interval. A buyer cannot adjudicate between them, because there is nothing to adjudicate.

The published doctrine does exist. It simply says something none of those pages says.

No Indian law requires a sweep. Here is what actually applies

We looked for an obligation across data protection, securities regulation, banking, telecom licensing, defence production and government security policy. We could not verify a single Indian law, rule, regulation, circular, direction or licence condition that requires a technical surveillance countermeasures sweep, at any interval, in any sector. What exists is adjacent, and it is worth knowing precisely because it tells you where the regulatory weight actually sits.

The Information Technology Rules of 2011 are the only Indian instrument that names physical security in this context. Rule 8(1) treats a body corporate as compliant if it has a documented information security programme containing managerial, technical, operational and physical security control measures commensurate with the information assets being protected. There is a precision point here that most commentary gets wrong. Rule 8(4)'s requirement of an audit at least once a year by a government approved independent auditor is not a freestanding universal duty. It is the condition of a deemed compliance safe harbour for organisations taking the ISO 27001 route or a notified code of best practices. An organisation relying on Rule 8(1) directly is not under an express annual audit obligation; its duty on a breach is to demonstrate that it implemented what its own documented programme said.

The security manual for licensed defence industries, revised by the Ministry of Defence in June 2025 and imposed as a condition of the industrial licence, is India's most security prescriptive published document of this kind. It requires an internal security audit at least yearly and an external audit by Ministry agencies once in two years. It describes mobile phones as effective, unobtrusive listening devices for eavesdropping, and its prescribed control is an outright ban: phones are not permitted inside conference halls, operations rooms or at official briefings even in switched off mode, and visitors deposit theirs at reception. Across both the current edition and the 2014 edition it replaced, the terms technical surveillance, TSCM, sweep, bugging and covert appear zero times. India's most prescriptive security manual does not require a sweep. It requires banning the phone and auditing annually.

One further detail from that manual is worth carrying, because it cuts against the instinct that more is always better: the 2014 edition required an internal audit twice a year. The 2025 revision relaxed it to yearly.

The rest of the Indian landscape points consistently in one direction. SEBI's insider trading regulations require a structured digital database recording who unpublished price sensitive information was shared with, maintained internally with time stamping and audit trails and preserved for at least eight years. SEBI's cybersecurity framework of August 2024 requires physical access to critical systems to be restricted, monitored and recorded continuously, and sets half yearly cyber audits for market infrastructure institutions and annual ones for other regulated entities. The Reserve Bank's technology directions require physical and environmental controls at data centres and disaster recovery sites. The CERT-In directions of April 2022 require incident reporting within six hours and 180 days of rolling logs, and their twenty incident categories do not include a covert listening device, a hidden camera or any physical surveillance device at all.

Read together, the pattern is unmistakable. Every Indian instrument that actually binds anyone points at logs, access control and records. None points at the room. SEBI will ask for your database. Nobody will ask whether the boardroom was examined.

And the one Indian rule that says "physical" is on a clock

This is the part that has moved recently and that nobody has written about. The Digital Personal Data Protection Act, 2023 was brought into force in tranches by a commencement notification published in November 2025. Most of the operative provisions, including section 8(5) on reasonable security safeguards, sit in the eighteen month tranche, which falls around the middle of May 2027. So does section 44(2), which omits section 43A of the Information Technology Act and the rule making power under which the 2011 Rules were made.

What replaces Rule 8 is Rule 6 of the Digital Personal Data Protection Rules, 2025, which sets a minimum list of reasonable security safeguards: encryption, obfuscation or masking; access control to computer resources; visibility through logs, monitoring and review; backups; one year log retention; contractual terms with processors; and appropriate technical and organisational measures. The word physical does not appear anywhere in it, and its access control limb is expressly scoped to computer resources as the Information Technology Act defines them.

So the honest story is the opposite of a sales pitch. India's incoming data protection regime is narrower on physical security than the one it replaces. One caveat worth stating: the 2025 Rules contain no repeal or savings clause for the 2011 Rules, so what formally happens to them once section 43A goes is unresolved on the face of the instruments.

What the published doctrine actually says about frequency

The clearest statement comes from the United States Department of Defense instruction that governs its own countermeasures programme. Its programme managers are told to recommend a facility technical threat analysis to determine whether a sweep is warranted at all, and then, in six words that contradict the entire vendor consensus: facilities may not automatically receive a recurrent TSCM. Approval is for facilities assessed as probable and feasible targets. There is no interval anywhere in the document.

Note which thing that doctrine treats as continuous. It defines a technical threat analysis as a continual process of compiling and examining information on technical surveillance activities. The sweep is the discrete, requested, approved output of that process. Provider content has inverted this: the sweep becomes continual and the threat analysis is absent.

The United States federal control catalogue is more interesting still. NIST Special Publication 800-53 contains control RA-6, a technical surveillance countermeasures survey, described as including visual, electronic and physical examinations of a facility internally and externally. Two things about it matter. The control makes frequency an organisation defined parameter, and offers "when the following events or indicators occur" as an alternative to any frequency at all. The authority declines to pick a number in the control's own syntax.

And then it goes further. We checked NIST's machine readable baseline files directly. RA-6 is selected for no baseline: not Low, not Moderate, not High. Vulnerability scanning sits in all three. The most security conscious published control catalogue in the world defines a TSCM survey, then declines to make it a default at any impact level. It remains available by tailoring, when an organisation's own risk assessment calls for it. That is precisely the argument of this page, stated by the framework's own authors.

British practice says the same thing in gentler language. The Cabinet Office's guidance for working at SECRET tells organisations to also consider periodic counter eavesdropping sweeps of controlled office areas that frequently host SECRET meetings, which makes the trigger usage rather than the calendar. The guidance for TOP SECRET says sweeps "should be undertaken periodically to ensure the integrity of the meeting space", and names no number. If the British government will not set an interval for TOP SECRET meeting rooms, nobody can honestly set one for a boardroom.

One more thing is worth saying plainly, because it is occasionally claimed otherwise. The Department of Defense instruction notes that its activities are conducted in accordance with a manual whose designation marks it Secret. There is no public TSCM methodology standard. Anyone citing one is mistaken.

The triggers that are defensible

If not the calendar, then what. These are the triggers that published doctrine actually names.

The sixth is the one we would single out, because no provider page we inspected mentions it. Two national authorities independently trigger on entry rather than on the calendar. A boardroom that has just taken delivery of a new video conferencing system and a boardroom that nothing has entered since the last examination are on an identical schedule under every vendor model, and on completely different footings under the official one.

Survey and inspection: why a first examination and a repeat are not the same purchase

The Department of Energy's facilities security plan draws a distinction that providers almost never do. A survey is the most comprehensive activity: a thorough technical, physical and visual examination of an area to identify hazards and the presence of devices. An inspection is a limited activity addressing specific concerns, which evaluates the changes to an operating environment to see whether modification or upgrade has inadvertently created a vulnerability.

The survey establishes the reference state. The inspection checks what has changed against it. NIST's description of RA-6 closes the loop: a survey provides useful input for risk assessments and information about organisational exposure, which is to say that the first examination partly exists to generate the information that sets the interval.

We should be honest about the vocabulary. The word baseline is ours, not theirs; the structure is in the primary documents, the term is not. It is worth noting that where provider pages use the word at all, they use it to mean a default interval, which is close to the opposite of this meaning.

When a sweep is the wrong thing to buy

This is the section no competitor writes, and the sourcing for it is better than the sourcing for any interval.

The Department of Defense's earlier instruction addressed facilities not normally used for sensitive discussion and open to uncontrolled access. Surveys of such facilities, it records, have proven counterproductive by having given the occupant or occupants a false sense of security, and such requests should be approved only if no other facility is available, because they consume scarce resources that could serve more sensitive sites. That is a government authority stating that a sweep in the wrong place is worse than no sweep, not merely wasteful.

The second case is the device that is already in the room. MITRE's catalogue of observed techniques records adversaries using a computer's microphone, webcam or call applications to capture conversation, written to disk and sent out later. No radio search detects that. And the primary control that three national authorities actually prescribe for this risk is not a sweep: it is the phone ban in India's defence security manual, the device restriction in the Ministry of Home Affairs information security guidelines, and, tellingly, one of the five things the United Kingdom's national counter eavesdropping authority says an inspection checks is human behaviour, meaning whether people are obeying procedures such as the ban on phones.

Which licenses a blunt conclusion. An organisation that has not banned and enforced the phone is buying an examination of a control it does not have. One with no physical access log, no device policy and no record of who was told what has cheaper, and in some cases legally required, work to do first.

What a programme covers that one sweep does not

If recurrence is warranted, what you are buying should be more than the same visit repeated. The Department of Energy's plan enumerates six distinct services, of which the comprehensive sweep is one: survey, inspection, in-conference inspection, advice and assistance, education, and special services for unforeseen circumstances.

Four of those are worth naming because they are routinely absent from what gets sold. Change detection against a known reference state, with entry of new equipment, furnishings or gifts as a trigger. Pre-installation advice, before a conferencing or telephone system goes live, which is the cheap moment. Education, so that the people using the room understand the threat and the procedures. And the operational security of the engagement itself: the Department of Energy is explicit that discussions and requests about a pending examination must not take place in the area to be examined, and the Department of Defense requires requests to come via secure communications from outside the facility concerned. A client who emails a provider from the boardroom to arrange an examination of that boardroom has already undermined it.

One claim often made here we will not make for you as doctrine. It is widely said that a sweep's result is valid only for the moment it was performed. No authority we read states that in terms. What they do say is that environments change, that inspections exist to evaluate those changes, that repetition preserves the integrity of a meeting space, and that threat analysis is continual. The conclusion follows from those, but it is an inference rather than a quotation, and we would rather label it as one.

The Indian record, stated honestly

We looked for a documented Indian case of a covert device found because of a periodic or scheduled check. We could not find one.

Deliberate scheduled sweeping in India demonstrably exists: the Parliament complex runs daily anti sabotage checks across both Houses when in session. The documented finds from them are a bundle of cash on a member's seat and explosive material near an event route. Not surveillance devices. India's institutional sweeping culture is shaped by the physical threat, not the signals one.

The best documented Indian commissioned sweep found nothing. In 2010 a suspected bugging at a Union ministry led to a sweep arranged through a private agency, and then to an Intelligence Bureau examination that concluded the adhesive found at sixteen points was chewing gum. Former intelligence officials publicly questioned the use of a private agency. The episode ended unresolvable, and it ended that way partly because there was no reference state to compare against and no clean chain of custody. We covered how that case reads as a cautionary tale about interpreting objects in a room in our guide to office indicators. Read for this question, it argues for a baseline rather than for a schedule.

Every other documented Indian discovery we could trace was accidental: someone noticing a camera while changing, a driver finding trackers while cleaning a vehicle, an employee seeing a device fall. That is a finding about how these things actually surface, and it is not an argument for a quarterly invoice.

So how should you decide

Start with the question the doctrine starts with: is this space a probable and feasible target, on a documented assessment rather than on a feeling. If the answer is no, the honest recommendation is not to buy. If it is yes, the inputs that published authorities actually name are the sensitivity of what is discussed in that specific room, how often it is genuinely used for that, what access control and device policy already exist and whether they are enforced, whether the space shares walls, floors or services with tenants you do not control, what has physically changed since it was last examined, and whether there is any known or suspected hostile technical activity in the area.

Those inputs produce a plan for a particular organisation. They do not produce a number that can be printed on a web page, which is exactly why no authority prints one, and why we will not either.

What an examination can and cannot establish

An examination reports what was found in the areas accessed, by the methods used, under the conditions present, at the time of the visit. It cannot prove a room has never been compromised, and it cannot keep it clean afterwards. It does not reach a compromised laptop or conferencing system, and it does not reach the person in the room who simply repeats what was said. If you want the mechanics of how a sweep is scoped and what it involves, our national guide covers it; the guide to corporate espionage sets out what Indian law actually protects when information leaves a company, and the guide to phone monitoring covers the handset, which no room examination touches.

Frequently asked questions