Is the Nationaal TSCM/EVO Beleidsadvies public?

No. VIRBI 2025 names the document but does not publish it. The same holds for the policy advice on compromising emanations (VBV 32000) and for the NATO and EU documents in this series; according to the AIVD those are obtainable from the NBV by interested parties.

From which classification level does the examination obligation apply?

In the table of minimum physical security requirements in VIRBI 2025, the two provisions on TSCM/EVO are marked at Staatsgeheim CONFIDENTIEEL, Staatsgeheim GEHEIM and Staatsgeheim ZEER GEHEIM. There is no mark at Departementaal VERTROUWELIJK. The general provision on countering eavesdropping does apply at all four levels.

How often must a secured zone be examined again?

VIRBI 2025 says ‘periodically’ without naming an interval, and additionally ties the examination to every structural alteration and to the addition of new items. The decree names ICT equipment, furniture, paintings and corporate gifts as examples. The frequency follows from the policy advice referred to and from the organisation’s own risk assessment.

Is a commercial sweep the same as the examination intended here?

No. In the classified context the services carry out the examination or set the conditions. A commercial examination cannot take its place. It can have value as preparation, for environments outside that regime, or as substantiation of an organisation’s own risk assessment.

Knowledge base

The Dutch national TSCM/EVO policy advice

The Nationaal TSCM/EVO Beleidsadvies is the national framework that the Dutch government information security decree for classified information, VIRBI 2025, refers to for the question of when and how a room must be examined for eavesdropping and observation devices. VIRBI 2025 names the document and attaches two obligations to it: an examination before a secured zone is taken into use, and an examination periodically and on every structural alteration or addition of items.

The policy advice itself is not published. What is public is the obligation that follows from it, the classification level at which it applies and the body responsible for it; everything that follows rests on those public sources alone.

Where the policy advice sits in the system

VIRBI 2025 entered into force on 9 September 2025, replacing VIRBI 2013, whose last day of validity was 8 September 2025. The decree applies to central government and describes how classified information is graded and protected.

Classified information has four levels: Departementaal VERTROUWELIJK (Dep.V), Staatsgeheim CONFIDENTIEEL (Stg.C), Staatsgeheim GEHEIM (Stg.G) and Staatsgeheim ZEER GEHEIM (Stg.ZG). The annex to VIRBI 2025 contains, per subject, a table of minimum measures indicating for each level whether a measure is mandatory.

The provisions at issue here are in the table of minimum requirements for the physical security of sites and buildings. That is where the Nationaal TSCM/EVO Beleidsadvies is named, alongside a second policy document on compromising emanations.

What VIRBI 2025 requires in concrete terms

Four provisions from that table are relevant here. The first applies at all four levels, the other three from Staatsgeheim CONFIDENTIEEL upwards.

Countering eavesdropping (all levels). Countering eavesdropping, including of spoken information, and of sight of and reflection of information, for example via displays or reflective surfaces.
TEMPEST measures (Stg.C and above). Measures in accordance with the policy advice on compromising emanations, the communications security regulation VBV 32000. A footnote states that advice on this can be requested from the National TEMPEST Authority.
Examination before commissioning (Stg.C and above). Before a working space or other secured zone is taken into use, a TSCM or electronic security examination must have been carried out in accordance with the Nationaal TSCM/EVO Beleidsadvies, and a sound attenuation measurement where necessary.
Examination on change (Stg.C and above). Periodically, and on every structural alteration or the addition of new items in a secured zone, the same examination must take place. The decree names ICT equipment, furniture, paintings and corporate gifts as examples of such items.

That last list is not incidental. It makes clear that the trigger is not only building work, but everything that enters the room and stays there.

Two moments, no fixed interval

VIRBI 2025 ties the examination to events: commissioning and change. The word ‘periodically’ also appears, without the decree naming an interval. Which frequency is appropriate therefore does not follow from the decree itself but from the policy advice it refers to, and from the organisation’s own risk assessment.

The same construction appears in the Dutch government security requirements for contracts. ABRO requirement 3.3.31 states that before a compartment is taken into use and on the addition or alteration of equipment, an electronic security survey and a sound attenuation measurement have been carried out in coordination with the NBIV. Requirement 3.3.32 does the same for TEMPEST measures and adds that the instructions for those measures can be requested from the NBIV.

The pattern is identical in both regulations: the regulation names the moment and the type of examination, and refers for the execution to a document or a body that does not publish.

Who sets the policy and who carries it out

In the Netherlands the National TEMPEST Authority sits with the National Communications Security Bureau (NBV) of the AIVD. National policy against compromising emanations is laid down in VBV 32000 (B) of 6 November 2006. The NBV also holds the civil National Security Authority task for NATO, the EU and ESA.

For contracts of the Dutch government and the police, the National Industrial Security Bureau (NBIV) has been the point of contact since March 2025. The NBIV is a joint unit of the AIVD and the MIVD, formed by merging the industrial security departments of both services, and supervises the ABRO declaration.

In the classified context the examination is carried out by the services themselves. In its 2025 annual report the AIVD states that 124 rooms were swept that year, in cooperation and coordination with the MIVD and the police. The service describes that work as examining the room with unique knowledge and means, looking for eavesdropping devices, hidden cameras and other sensors.

The international layer

For NATO and EU classified information, the policy of those organisations applies. The NBV names a series of documents that sit alongside the national framework.

NATO: SDIP-27/3 and SDIP-29/3 (both November 2024), SDIP-28/3 for zoning procedures (November 2024) and SDIP-55/1 (May 2024).
EU: IASG 7-01 (September 2013), IASG 7-02 for zoning procedures (November 2012), IASG 7-03 (June 2013) and IASG 7-04 (March 2019).

As National TEMPEST Authority, the NBV can register manufacturers of TEMPEST equipment as a TEMPEST company with NATO and the European Union on request. Those companies appear on the NATO List of Certified TEMPEST Vendors and the EU List of Accredited TEMPEST Companies, and are visited periodically against SDIP-55 and IASG 7-04. After inspection, products receive a TEMPEST identification and tamper-evidence seal, obtainable through the NTA.

This recognition concerns the making of equipment, not the carrying out of examinations. A provider of sweeps is therefore not a ‘NATO-certified TEMPEST company’ because it uses measurement equipment, and a supplier that does appear on that list does not thereby deliver examinations.

What you can and cannot infer from this

The Nationaal TSCM/EVO Beleidsadvies is not published. What can be established from outside is the place it occupies in the regulations and the obligations attached to it in VIRBI 2025, but not what it says. Anyone who needs the content is directed to the NBV or, in an ABRO process, to the NBIV.

Nor does the reference mean that a commercial examination equals the examination intended in that framework. In the classified context the services carry out the examination or set the conditions under which it takes place. What a commercial party can deliver is examination outside that formal regime: as preparation for a process, for environments that fall outside it, or as substantiation in an organisation’s own risk file.

For organisations that fall under neither VIRBI nor the ABRO, the construction is still usable. The two moments the decree identifies, commissioning and change, are sound anchors for any organisation that uses a room routinely for confidential discussion. They say nothing about which depth of examination is appropriate in your situation; that follows from your own threat profile.

Sources

Besluit voorschrift informatiebeveiliging rijksdienst bijzondere informatie 2025 (VIRBI 2025), in force from 9 September 2025. The annex contains the table of minimum physical security requirements in which the Nationaal TSCM/EVO Beleidsadvies and VBV 32000 are named, with applicability per classification level.
Staatscourant 2025, 30222, 8 September 2025. The publication of VIRBI 2025.
VIRBI 2013, valid from 1 June 2013 up to and including 8 September 2025. The predecessor, now withdrawn.
AIVD. “Nationale TEMPEST Autoriteit (NTA).” Source for the NTA task sitting with the NBV and for VBV 32000 (B) of 6 November 2006.
AIVD. “TEMPEST-bedrijven, normen en beleidsstukken.” Source for the NATO and EU documents, the two lists of TEMPEST companies and the seals.
AIVD. Annual report 2025. Source for the figure of 124 rooms swept and for the description of that work.
AIVD. “Nieuwe vereisten voor nationale veiligheid bij overheidsopdrachten.” November 2025. Source for the NBIV as a joint unit of the AIVD and the MIVD.
Algemene Beveiligingseisen voor Rijksoverheidsopdrachten 2026 (ABRO 2026). Source for requirements 3.3.31 and 3.3.32.

Frequently asked questions

Is the Nationaal TSCM/EVO Beleidsadvies public?: No. VIRBI 2025 names the document but does not publish it. The same holds for the policy advice on compromising emanations (VBV 32000) and for the NATO and EU documents in this series; according to the AIVD those are obtainable from the NBV by interested parties.
From which classification level does the examination obligation apply?: In the table of minimum physical security requirements in VIRBI 2025, the two provisions on TSCM/EVO are marked at Staatsgeheim CONFIDENTIEEL, Staatsgeheim GEHEIM and Staatsgeheim ZEER GEHEIM. There is no mark at Departementaal VERTROUWELIJK. The general provision on countering eavesdropping does apply at all four levels.
How often must a secured zone be examined again?: VIRBI 2025 says ‘periodically’ without naming an interval, and additionally ties the examination to every structural alteration and to the addition of new items. The decree names ICT equipment, furniture, paintings and corporate gifts as examples. The frequency follows from the policy advice referred to and from the organisation’s own risk assessment.
Is a commercial sweep the same as the examination intended here?: No. In the classified context the services carry out the examination or set the conditions. A commercial examination cannot take its place. It can have value as preparation, for environments outside that regime, or as substantiation of an organisation’s own risk assessment.

Read more about our electronic security surveys and TSCM sweeps.

Written by Kris Oosthoek PhD · Published 2026-09-29