To what extent should TEMPEST mitigation be incorporated into designs according to CTTAs?

• A. Only when specified by law
• B. To the maximum extent practicable
• C. Based on contractor recommendations
• D. As per budget limitations

Answer: (B)

The correct choice emphasizes that TEMPEST mitigation should be integrated into designs to the maximum extent practicable. This approach aligns with the guidelines established by the Communications Security Technical Authority (CTTA), which prioritize the importance of safeguarding sensitive information from potential emissions that could be intercepted.

By incorporating TEMPEST measures to the maximum extent practicable, the system design actively addresses the risks associated with electromagnetic emissions. This leads to a more robust security framework, ensuring that even in non-ideal conditions, adequate protections are in place. This principle fosters a proactive stance on security, encouraging designers and engineers to assess the risks and implement appropriate countermeasures rather than considering these protections only as optional or based on external factors like budget constraints or specific legal mandates established elsewhere.

In relation to the other options, they suggest a less rigorous or subjective approach, such as only implementing mitigation when legally required, relying solely on contractor advice, or limiting actions based on available funding. These options imply a reactive or minimalistic stance that could jeopardize the security of sensitive data, which is not in line with the CTTA's emphasis on comprehensive risk mitigation.