RA-6 Technical surveillance countermeasures survey: requirements and evidence

What RA-6 asks for and why it is selected rarely

RA-6 requires technical surveillance countermeasures surveys at locations the organization defines, either on a schedule or when defined events occur. A TSCM survey is a physical inspection, often by specialists with dedicated equipment, that searches a room or facility for eavesdropping devices and other technical means of listening in on sensitive discussions. If your tailored control set or overlay includes RA-6, the control is a physical-security commitment, not a software or scanning task, and it sits in the risk assessment family because it responds to the threat of covert surveillance at specific places.

SP 800-53B does not assign RA-6 to any low, moderate, high or privacy baseline, so it appears only when your organization or an overlay selects it. Appendix C of SP 800-53 Rev. 5 marks it as implemented by the organization and as assurance-related. In Release 5.2.0 it has 4 organization-defined parameters and no control enhancements, so the work is almost entirely in deciding the parameters. FedRAMP's Rev5 baselines do not require RA-6 at Class B, C or D, which explains why most cloud and federal authorizations never encounter it. Confirm the selection in your system security plan before assuming it applies.

The control is hard to satisfy because the organization must define the locations, the schedule and the triggering events itself, and the surveys need qualified people and specialized equipment that most IT or compliance teams do not hold in-house. Ask who will define the parameters, which rooms or sites qualify as sensitive, and which events, such as a new facility fit-out or a board-level meeting, will trigger a survey. Any provider you engage should be able to show the qualifications of the people performing sweeps, and the report they deliver should go to the authorizing official as assessment evidence.

Which rooms, events and teams RA-6 reaches

RA-6 applies only where the organization selects it, so the first decisions are which locations, triggering events and owners fall inside the survey program. Each card below is a scoping choice that changes the schedule, the budget and the evidence an assessor will ask for.

Sensitive locations to survey

Start with the rooms where sensitive discussions happen: executive offices, boardrooms, secure meeting rooms and any facility that hosts classified or high-impact information. Record each location in the RA-6 scope statement with its floor plan, room identifier and the discussions it supports. Ask who decides when a room is added or retired, because an unlisted room is one an assessor can reasonably say was never surveyed. Confirm this list against the system security and privacy plan so it matches the authorization boundary.

Events that trigger unscheduled surveys

RA-6 allows surveys on a schedule or when defined events occur, so the organization must name those events in advance. Typical triggers include new construction or renovation near a sensitive room, a security incident involving suspected eavesdropping, and visitor or contractor access to a sensitive area. Write each trigger as a rule with an owner and a response time, and keep the record of when each trigger fired. Assessors test whether triggered surveys actually happened, not only whether the triggers exist on paper.

Internal teams that own locations

Physical security usually owns access control and visitor logs, facilities owns construction and building systems, and the information security office owns the risk decision and the evidence. Those three groups often share a sensitive room without a shared record of who entered it or what work was done. Assign one accountable owner for each location and agree who notifies whom before any work starts. Without that handoff, a survey can be scheduled after the room has already been changed.

External TSCM providers

Many organizations buy surveys from specialist technical surveillance countermeasures providers rather than building that skill in-house. The contract should state the locations covered, the methods used, the reporting format and who receives the findings. Confirm how the provider's personnel are vetted and how sensitive findings are handled before the report is issued. The organization still owns the control, so the provider's report becomes one piece of evidence inside the organization's own RA-6 record.

Landlords and building contractors

Leased space and shared buildings add parties who can alter a sensitive room without the organization's knowledge. Landlords, building management and construction contractors may control HVAC, cabling, ceilings and access panels. Review lease terms and contractor agreements for notice requirements and access rights that let the organization schedule a survey after any work. Ask for the building's work permit records during each survey cycle, since they show when a room was opened.

Scope drift between cycles

Rooms are repurposed, teams move and buildings change, so the RA-6 scope can drift quietly between survey cycles. Compare the current room list, visitor logs and construction records against the last survey report at each review. Record any location added, removed or reclassified, and update the sensitive-location list with the reason. An assessor who finds a room used for sensitive discussions but absent from the scope will treat the gap as a control failure.

How an assessor tests RA-6

This table walks through how an assessor applies the one SP 800-53A determination statement for RA-6 using examine, interview and test methods, and what each method looks for. Read it as a checklist of what to have ready before an assessment, since assessors measure the survey program against the parameters your organization defined.

Assessment element	What the assessor does	Evidence to have ready
Determination statement	Confirms that the organization's defined survey locations and the schedule or triggering events are actually implemented, as the single RA-6 determination statement requires.	Written survey schedule, defined locations and defined trigger events, with the approval record for each.
Examine method	Reviews audit records and event logs, along with survey plans and reports, to confirm surveys ran on the schedule and after each defined trigger.	Survey logs, dated survey reports, and records showing which events triggered an unscheduled survey.
Interview method	Asks the personnel who run surveys and the facility owners how locations are chosen, how triggers are recognized and who decides whether a survey is needed.	Named survey owners, a trigger escalation path, and staff who can explain the process consistently.
Test method	Observes or samples a survey in progress or a recent survey to check that the sweep covers the defined locations and that the results are recorded accurately.	Scope checklist per location, equipment list used in the sweep, and a sample of completed sweep records for observation.
Survey personnel qualifications	Checks that the people performing surveys have documented training or experience appropriate to the work, and that the organization can show who was on each survey.	Training or qualification records for each surveyor and the sign-off roster for each survey.
Remediation records	Traces any suspected or confirmed technical surveillance finding to a documented response, including investigation and follow-up sweeps.	Incident or finding tickets, investigation notes, and records of follow-up surveys after remediation.
Common finding: undefined locations	Notes when the organization cannot show which locations are in scope, so no survey can be measured against a defined set.	A current, approved list of sensitive locations tied to the system or facility boundary.
Common finding: no record after a trigger	Notes when a defined event occurred, such as a reported concern or a change in a sensitive area, but no unscheduled survey was recorded.	Event-to-survey correlation records showing a survey or documented decision not to survey after each trigger.
Common finding: reports that do not show scope	Notes when a survey report states that a sweep was performed without listing the areas, the methods or the equipment used.	Reports that name each location swept, the date, the method, the equipment and the result for each area.

Implementing RA-6 in six steps

This sequence turns RA-6 from a line in a policy into a repeatable survey program, with a defined scope, set frequency and triggers, a qualified survey team, a written procedure, a baseline survey result and a documented loop that moves findings into the risk register and POA&M.

Define sensitive locations and their sensitivity
The system owner, facilities or physical security lead and the risk function list the rooms, buildings and areas where discussions, system administration or sensitive processing take place, then rate each one by sensitivity and by who can access it. The output is a location register that names each site, its occupants, its adjacent spaces and the reason it is in scope. The step is done when the authorizing official or designated owner signs off the register, because every later parameter depends on it.
Set frequency and event triggers
RA-6 leaves the survey frequency and the triggering events to the organization, so this step fills in those organization-defined parameters. The team sets a recurring survey interval for each location tier and lists events that prompt an unscheduled survey, such as new construction, renovation, new furniture or equipment delivered into a sensitive room, a visitor incident, or a reported anomaly. The output is a parameter table approved by the risk owner. Confirm the exact parameter wording against the SP 800-53 Rev. 5.2.0 catalog and your own policy before adoption.
Select the survey provider and document competence
Decide whether an in-house team with trained technical surveillance countermeasures staff will run the surveys, or whether an external specialist will do so under a written scope. Either way, record each surveyor's training, certifications where they apply, experience, and conflicts of interest, and keep the file with the security program records. Equipment calibration and handling procedures should also be documented. DeployOpen can plan and document the program and support the survey environment, but a technical surveillance countermeasures survey is a specialized physical service that the organization must procure or staff directly. The output is a qualified team file and a signed statement of work.
Write the survey procedure and reporting format
The procedure states how a survey is prepared, who is notified, how the premises are secured during the sweep, which methods and equipment are used, how suspected devices are isolated and handled, and what must be recorded. The reporting template fixes the fields every report must contain, including the location, date, team, methods, findings, unresolved items and the reviewer's name. Assessors will look for this procedure in the RA-6 evidence, and SP 800-53A examines audit records and event logs, so the template should produce a consistent record. The output is an approved procedure and a report template under configuration control.
Run the baseline survey and record results
The first full survey covers every location in the register using the approved procedure. The team records each area swept, the methods applied, any anomalies and the disposition of each item, and the custodian of each location countersigns the result. Findings that cannot be closed on the day are logged as open items with an owner. The output is a signed baseline survey report for each location and a consolidated summary that becomes the reference for future comparisons. Keep the raw logs, because the examine method in SP 800-53A relies on them.
Close the remediation and reassessment loop
Each finding is routed to the risk register as a risk entry with an impact and likelihood rating, and any finding that needs time to fix is recorded in the plan of action and milestones with an owner and a closure check. The loop reopens the location for reassessment after remediation, and the result is recorded as a new survey entry rather than overwriting the old one. Trend data from successive surveys feeds the next review of the location register and the parameters set in step two. The step is done when the risk owner has accepted or closed every finding and the next scheduled survey is on the calendar.

How a TSCM survey is structured and where evidence comes from

A technical surveillance countermeasures survey for RA-6 runs in phases, and each phase should leave a record that an assessor can examine. The first phase is a pre-survey briefing between the organization and the team performing the survey. In it, the organization confirms the defined locations, the events that trigger a survey outside its schedule, the people who may be present during the work, and which areas are off limits or restricted. The signed or dated briefing note, the agreed location list and the schedule are the records that show the parameters RA-6 asks the organization to define were actually set and approved. Confirm with the survey provider what they will write down before they arrive, because an assessor will look for a document that matches the work that was done.

The middle phases are the physical and technical sweep of the defined area and the inspection of telephone, network and building services that run into it. The sweep record should name each space covered, the date and time, the people who attended, and any exceptions, such as areas that could not be accessed. The inspection record should list the service entry points, cabling and equipment examined, and what was not examined and why. Both records matter because an assessor cannot judge coverage from a summary alone. Ask the provider how exceptions are logged and how they are closed out, since open exceptions are where gaps usually sit.

The final phase is the report of findings and recommendations, which the organization should treat as the central evidence item for RA-6. A useful report states what was tested, what was found, what was ruled out, and what actions are recommended, with an owner and a date for each action. Findings then feed the organization's risk assessment and, where they require remediation, its plan of action and milestones. DeployOpen does not run TSCM surveys unless the written scope says so. Where a survey is in scope, the survey itself is a physical-security activity that the organization owns, including who authorizes it, who receives the report and who acts on the results.

Evidence that passes an RA-6 review

An assessor testing RA-6 looks for a documented survey program that matches the organization-defined parameters, plus proof that surveys ran as planned and that findings were fixed. The cards below cover the artifacts that connect the schedule, the locations, the survey results, the event-driven surveys, the remediation trail and the people doing the work. Each one should be kept current between assessments, not rebuilt for them.

Documented schedule and event triggers

The survey frequency and the defined events that trigger an unscheduled survey are the organization-defined parameters for RA-6. Record the values you chose, the date they were approved and the owner who approved them. An assessor will compare each survey date against this schedule, so the document should state the frequency in terms your team can measure, such as the calendar cadence and the specific events that count, for example relocation of a sensitive meeting room or a reported security concern. Confirm that the parameter values in your policy match the values your survey logs actually follow.

Register of defined locations

Maintain a list of every location covered by the survey program, with a sensitivity rating and the reason for that rating. Typical entries include executive offices, boardrooms, secure rooms used for sensitive discussions and areas where system design work takes place. Each rating should drive the survey frequency, so a high-sensitivity room should never be surveyed less often than a lower-rated one. Review the register when floor plans change, when a team moves, or when a new facility is added, and record the date of each review.

Survey reports with method and findings

Each survey report should state the date, the area covered, the method used and the findings, including negative results. The method section should name the equipment and the search approach so an assessor can judge whether the survey was capable of finding what it was meant to find. Store the report with the location register entry it covers. Be careful with report access: these documents describe the weaknesses of your sensitive spaces, so restrict who can read them and log each access, in the same way you would protect other sensitive security records.

Records of unscheduled surveys

When a defined event occurs, the survey must happen on the trigger, not on the next routine date. Keep a log that records each triggering event, when it was reported, when the survey started and finished and who performed it. A gap between the event and the survey is the first thing an assessor will question. If no event occurred during the period, record that too, so the absence of unscheduled surveys is documented rather than assumed.

Remediation tickets and re-survey results

When a survey finds technical surveillance, the response needs its own trail: a ticket opened, an owner assigned, containment steps recorded, the removal confirmed and a follow-up survey completed to show the space is clear. Link each ticket to the survey report that raised it. Assessors look for closure, not just detection, so a finding without a re-survey record will read as open. Record who decided whether a location could be used again and on what date.

Competence records for survey personnel

The people who run surveys need documented training and experience in the search methods they use. Keep a current record for each surveyor that shows the training completed, the equipment they are authorized to operate and any independent review of their work. Where surveys are contracted, the contract should require the provider to supply the same records and to name the individuals who will perform the work. Update the records when staff change, because a survey performed by someone without a current record can be challenged even when the findings are correct.

What meeting RA-6 costs in money and effort

This table breaks down the cost and effort components of an RA-6 program, showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. Use it to build a written scope before asking vendors for quotes, since NIST does not estimate these costs and no supplied figure sets a price.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it up or down
External TSCM survey fees	Specialist TSCM provider, paid per survey under a written scope	Recurring per scheduled survey, plus one-time for event-triggered surveys	Number of defined locations, survey frequency, building size and layout, and number of event triggers
Location definition and scoping	Internal security or facilities staff, with legal or executive input	One-time to set up, then recurring when locations change	Number of sensitive rooms and sites, and how often the organization adds or moves them
Internal staff time for records	Security, compliance or facilities staff who log surveys, findings and follow-up	Recurring with each survey cycle	Volume of findings, number of sites, and whether records sit in an existing evidence system
In-house equipment and training	Internal team if surveys are run in-house, plus equipment purchases or rentals	One-time for equipment and training, recurring for calibration and refresh	Whether the organization runs surveys itself or buys them, and the specialist skill required
Remediation of findings	Facilities, IT or security teams, plus any contractor who removes or shields devices	Unpredictable; occurs after a finding and can recur	Number and severity of findings, the restructuring a room needs, and how quickly fixes are scheduled
Assessor sampling time	Independent assessor, billed under the assessment engagement	Recurring per assessment cycle	How many surveys and records the assessor samples, and how complete the evidence is on arrival
Open-source tooling	Minimal; no open-source tool replaces the physical survey	Recurring only for any supporting software	Low impact on total cost, so license spend is rarely the main driver

Which parts of RA-6 are worth outsourcing

The survey itself is the part most organizations outsource. A technical surveillance countermeasures sweep needs specialized detection equipment, trained operators who know how to tell a genuine emitter from ordinary electronics, and a method for checking sensitive rooms without tipping off whoever may have placed a device. Few internal security teams keep that capability on staff, and buying equipment for a survey that runs only at defined locations rarely makes economic sense. Ask any provider to state in writing which locations they will sweep, the methods and equipment they will use, how findings are reported, and how they handle a suspected device they find during the work, including who is notified and in what order.

The organization keeps the decisions that RA-6 actually assigns to it. Those are the defined locations, the survey frequency, the event triggers that call for an unscheduled survey (such as a new executive office fit-out, a visitor incident or a suspected breach of a meeting room), the people who receive reports, and the remediation owner for every finding. These parameters are organization-defined in Release 5.2.0, so they belong in a document the organization approves and can produce for an assessor. A provider can recommend values, but a provider should not be the party that decides them. Keep the survey schedule, trigger list and remediation tracking in the organization's own risk register or plan of action and milestones, not in the vendor's report.

DeployOpen does not perform TSCM surveys as part of its core scope. Its role is narrower: it can help prepare the documentation, the evidence structure (survey reports, scope records, remediation tickets and trigger logs) and a readiness review before an assessor arrives. Independent assessors, working from the procedure in SP 800-53A, judge whether the survey happened as defined and whether the evidence supports that conclusion. Confirm with any survey provider whether they will supply reports that an assessor can test directly, and confirm with your assessor which evidence they expect to examine before the first survey is scheduled.

Who owns each part of RA-6

Your organization owns RA-6 in full. RA-6 has four organization-defined parameters in Release 5.2.0, and those choices determine what the survey covers. Nobody outside your organization can decide which locations are sensitive, how often surveys run, or what event should trigger an extra sweep. Your security and facilities leaders also own the response when a survey finds something, because remediation and the decisions that follow it stay with you.

Locations and scope: Define the sensitive locations and rooms that the survey covers, and record the reason each one is in scope.
Triggers and frequency: Set the schedule and the defined events, such as a change in occupancy, a construction project or a reported incident, that require a survey.
Parameter decisions: Record the values you chose for each organization-defined parameter and the approver for those values.
Remediation: Own the response to any finding, including containment, removal of devices and any follow-up investigation.
Records: Keep the survey reports, equipment logs, schedules and corrective actions that show the control operated.

Before an assessment, confirm that someone on your staff can explain each parameter value and point to the records behind it.

Where organizations fall short on RA-6

RA-6 is an organization-defined control with no baseline default, so most gaps come from decisions an organization never wrote down. The cards below cover the places where a survey program looks finished on paper but would not hold up when an assessor examines the records and the locations.

Parameters never defined

RA-6 has 4 organization-defined parameters in Release 5.2.0, and each one has to be filled in before the control can be assessed. Organizations often leave the survey locations, frequency and event triggers blank because no baseline supplies them. Check that every parameter has a written value, an owner and an approval date. Ask the assessor to test against those values, not against general language about surveys.

Event triggers that exist only in policy

A policy may say that a survey follows travel to high-risk locations, a security incident, or the arrival of new construction, yet no one tracks those events. The control only works when the triggering events reach the people who schedule surveys. Connect each trigger to a named source, such as the travel approval system, the facilities request queue or the incident ticket, and test that one event produces one survey record.

Surveys run but not recorded by location

An assessor will look for records that tie each survey to a specific room, facility or area, with the date, the method used and the result. A sweep that produces only a general statement that the building was checked does not show coverage. Keep a location register with a unique identifier for each site and attach every survey report to it. Review the register against the list of sensitive locations the organization defined.

No link to the risk register

Survey findings, such as an unexplained device or an unauthorized recording system, describe risk that should be assessed under RA-3 and tracked under RA-7. When findings stay in the security office's email, the organization cannot show that they informed decisions. Open a register entry for each finding, record the response decision, and link it to the plan of action and milestones where it applies.

Personnel competence not documented

Technical surveillance countermeasures work depends on the skill and equipment of the people running it, and an assessor may ask who ran each survey and how they were qualified. Many organizations use contractors or internal staff without keeping training or certification records. Maintain a roster of personnel who conduct surveys, their qualifications, their training dates and the equipment each person is authorized to use.

Assuming a physical sweep covers digital monitoring

A physical survey searches a room for devices and cannot detect a compromised workstation, a monitored network or a collection tool running on a managed endpoint. Teams that treat the survey as their monitoring answer leave digital threats to other controls without testing those controls. Document the boundary of the survey in the control narrative and point the reader to the controls that cover logical monitoring, such as SI-4 for system monitoring.

RA-6 questions buyers ask before hiring help

Does any SP 800-53B baseline require RA-6 technical surveillance countermeasures surveys?

No. SP 800-53B does not assign RA-6 to the low, moderate, high or privacy baseline, so a system only carries RA-6 when the organization selects it through tailoring or adds it through an overlay. Appendix C of SP 800-53 Rev. 5 lists RA-6 as implemented by the organization and marks it as an assurance-related control. In practice, the decision usually comes from a sensitive-facility requirement, a classified or executive-protection mandate, or a risk assessment that finds a credible eavesdropping threat at specific locations. Before you commit budget, confirm with your authorizing official or contracting officer whether RA-6 appears in your agreed control set, and record the tailoring decision in your system security and privacy plan so an assessor can trace why the control is present or absent.

Does FedRAMP require RA-6 for cloud systems?

Not at the Class B, C or D impact levels. The FedRAMP Rev5 baselines in the 2026 Consolidated Rules (rule FRC-CSF-BSL) do not require RA-6 at any of those levels. That answer matters for cloud providers pursuing FedRAMP authorization, because adding RA-6 to a FedRAMP package would be a voluntary control decision rather than a baseline obligation. If an agency or sponsor asks for it anyway, treat the request as a scope change, agree the locations and frequency in writing, and confirm with the sponsoring agency how the results will be evidenced. The FedRAMP control reference for the Risk Assessment family is the place to check the current text before you size the work.

What drives the effort and cost of an RA-6 survey?

The main drivers are the number and type of locations, the frequency of surveys, and the sensitivity of the spaces being searched. Each of the four organization-defined parameters in Release 5.2.0 (the locations, the schedule, the defined events that trigger a survey, and related selections) changes how much work is required. A small conference room needs far less effort than a multi-floor facility with raised floors, shared telecom closets and frequent visitors. Costs fall into two groups: specialist labor for the sweep itself, including equipment and report writing, and internal time spent on access coordination, pre-survey briefings and remediation of anything found. Ask any provider for a quote that lists locations, survey frequency, after-hours access, equipment used and deliverables separately, so you can compare like with like.

Can our own team run technical surveillance countermeasures surveys?

Possibly, but the decision is about qualifications and accountability rather than tooling. RA-6 asks for searches for eavesdropping devices and other technical surveillance at defined locations, and the people performing those searches need specialized training and equipment that most IT or security teams do not hold. Open-source software cannot replace the physical sweep, although it can help you store results, track survey dates and link findings to the risk register. If you do build an internal capability, document who is authorized to conduct sweeps, how they are trained, how their work is reviewed and what they do when they find something. An assessor will test whether the surveys happened, whether they covered the defined locations and whether findings were handled, so the records matter as much as the sweep.

What does a surveillance countermeasures survey need from our facilities team?

The survey needs controlled access, accurate facility information and a clear rule for stopping work when something is found. Facilities staff usually provide floor plans, lists of rooms and utility routes, access to ceilings, floors and electrical panels where the survey requires it, and a schedule that avoids disrupting critical meetings. They should also agree how physical access is logged, since the surveyors' access is itself a sensitive event. Plan for after-hours or unoccupied windows for some spaces, and confirm who can authorize opening closed areas. Facilities teams also own remediation of physical findings such as unauthorized devices, unsecured cable paths or unmanaged vendor equipment, so agree those responsibilities before the first survey.

How does RA-6 differ from RA-5 vulnerability scanning?

RA-6 looks for physical surveillance in a room, while RA-5 looks for software and configuration weaknesses in systems. RA-5 covers vulnerability monitoring and scanning of networks, hosts, applications and databases, usually with automated tools that compare findings against vulnerability data. RA-6 uses trained people and specialized equipment to search physical spaces for devices such as hidden microphones or transmitters, and its output is a survey record rather than a vulnerability list. The two controls can share a risk assessment and a remediation workflow, yet they need separate evidence, separate owners and separate schedules. Open-source scanners can support RA-5 evidence directly, but they do not perform or substitute for RA-6 surveys.

What should we confirm with a provider before signing an RA-6 engagement?

Confirm the written scope, the locations, the survey frequency and the triggering events, along with who performs the physical work and what qualifications they hold. DeployOpen plans and delivers engagements under written, fixed scopes, but its security testing and cyber range services do not include physical technical surveillance sweeps unless that work is specifically agreed in writing, so ask directly which parts a partner subcontracts. Request sample survey reports, the handling process for findings and the evidence package you will hand to your assessor. DeployOpen prepares systems, controls and evidence for assessments, but an independent assessor is the party who tests and reports on RA-6. Ask every provider to state that boundary in the contract.

How DeployOpen prepares RA-6 evidence

DeployOpen works on RA-6 as part of an organization's own risk management program, not as a stand-alone certificate. We prepare the systems, logs and documented survey records an assessor would examine, while the organization keeps ownership of its countermeasure decisions. Independent assessors, not DeployOpen, judge whether the evidence meets the control.

How we scope

Confirm with the organization whether RA-6 is selected in its tailored baseline or overlay, since no SP 800-53B baseline assigns it.
Agree in writing which sensitive locations, meeting rooms or facilities fall in scope, and who performs the physical survey.
Define the survey trigger events and schedule the organization has chosen, so the written scope matches what an assessor will test.

How we build

Set up logging of survey requests, dates, locations, findings and remediation in a self-hosted system the organization controls.
Connect survey records to the audit trail and ticketing tools so that each survey and its follow-up can be traced later.
Draft survey procedures and report templates aligned to the single RA-6 determination statement and its examine and test methods.

How we hand over

Deliver documented survey procedures, configuration records, sample survey reports and an evidence index mapped to RA-6.
Provide a walkthrough so the organization's staff can run surveys and produce records without DeployOpen present.
Record open findings and assumptions in the system security and privacy plan or plan of action and milestones where the organization's process requires them.

How we support

Offer ongoing support, upgrades and retesting as a retainer when the organization wants continued help after handover.
Review survey records and logs at the cadence agreed in the scope to confirm evidence stays complete between assessments.
Coordinate with the organization's chosen independent assessor on evidence requests, but leave the assessment and any report to that assessor.