afi10-701.pdf

BY ORDER OF THE SECRETARY

OF THE AIR FORCE

AIR FORCE INSTRUCTION 10-701

24 JULY 2019

Incorporating Change 1, 9 JUNE 2020

Operations

OPERATIONS SECURITY (OPSEC)

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available on the e-Publishing website at:

www.e-Publishing.af.mil for downloading or ordering

RELEASABILITY: There are no releasability restrictions on this publication

OPR: AF/A3TY

Supersedes: AFI10-701, 8 June 2011;

AFI10-712, 17 December 2015

Certified by: AF/A3TY

(Col Schoepf)

Pages: 59

This publication implements Air Force Policy Directive (AFPD) 10-7, Air Force Information

Operations, Department of Defense Directive 5205.02, DoD Operations Security (OPSEC)

Program, Department of Defense Manual 5205.02-M, DoD Operations Security (OPSEC)

Manual. It provides guidance and procedures on operations security (OPSEC) throughout the

Air Force (AF). This AFI is consistent with the guidance in Department of Defense Instruction

(DoDI) 8560.01, Communications Security (COMSEC) monitoring and Information Assurance

(IA) Readiness Testing and AFPD 17-1, Information Dominance Governance and Management.

It applies to individuals at all levels including, the Air Force Reserve (AFR), Air National Guard, civilian and contractor personnel except where noted otherwise. Ensure that all records created as a result of processes prescribed in this publication are maintained in accordance with Air

Force Manual (AFMAN) 33-363, Management of Records and disposed of in accordance with

Air Force Records Information Management System (AFRIMS) Records Disposition Schedule

(RDS). Refer recommended changes and questions about this publication to the Office of

Primary Responsibility listed above using the AF Form 847, Recommendation for Change of

Publication; route AF Forms 847 from the field through the appropriate chain of command. This publication may be supplemented at any level, but all supplements that directly implement this publication must be routed to the Office of Primary Responsibility listed above for coordination prior to certification and approval. The authorities to waive wing/unit level requirements in this publication are identified with a Tier (“T-0, T-1, T-2, T-3”) number following the compliance statement. See AFI 33-360, Publications and Forms Management, for a description of the authorities associated with the Tier numbers. Submit requests for waivers through the chain of command to the appropriate Tier waiver approval authority, or alternately, to the requestors commander for non-tiered compliance items.

http://www.e-publishing.af.mil/

2 AFI10-701 24 JULY 2019

SUMMARY OF CHANGES

This interim change revises AFI 10-701 by (1) deleting OPSEC working group requirements in paragraph 2.18 and 2.19, (2) adding OPSEC working group requirements to the roles and responsibilities of the commander/directors, OPSEC Program Manager and OPSEC Signature

Manager in paragraphs 2.17, 2.20, 2.21 and 2.22, (3) adding OPSEC Signature Management responsibilities to paragraph 2.22, (4) revising mission-oriented training within paragraph 4.3, OPSEC program management assessments within paragraph 5.3.5 and Electronic System

Security Assessments within paragraph 6.6 A margin bar (|) indicates newly revised material.

Chapter 1—OPERATIONS SECURITY (OPSEC) OVERVIEW 6

1.1. National Security Decision Directive 298, National Operations Security Program requires each executive department and agency with a national security mission to have an OPSEC program

1.2. OPSEC is an information-related capability that preserves friendly essential secrecy by using a process to identify, control and protect critical information and indicators

1.3. Essential secrecy is the condition achieved by denying critical information and indicators to adversaries

1.4. OPSEC, when closely integrated and synchronized with other information-related capabilities, security disciplines and all aspects of protected operations, preserves essential secrecy

1.5. OPSEC supports planning, preparation, execution and post execution phases of all activities, operations and programs across the entire spectrum of military operations

1.6. Commanders and directors are responsible for identifying and managing signatures associated with Air Force activities, capabilities, operations, and programs

1.7. OPSEC is a commander’s/director’s responsibility and is established, managed and implemented at all levels throughout the AF

Figure 1.1. Air Force Operations Security Organizational Structure

1.8. OPSEC is everyone’s responsibility

1.9. To enhance the effectiveness and understanding of OPSEC:

1.10. Ideally, the Air Force uses OPSEC countermeasures to protect its critical information

1.11. Air Force OPSEC SharePoint Sites

AFI10-701 24 JULY 2019 3

Chapter 2—ROLES AND RESPONSIBILITIES 9

2.1. Air Force Judge Advocate General (AF/JA)

2.2. The Deputy Chief of Staff for Manpower, Personnel & Services (AF/A1)

2.3. The Deputy Chief of Staff for Intelligence, Surveillance and Reconnaissance

(AF/A2)

2.4. The Deputy Chief of Staff for Operations (AF/A3)

2.5. Deputy Chief of Staff, Logistics, Engineering and Force Protection (AF/A4)

2.6. Secretary of the Air Force Deputy Chief Information Officer (SAF/CN)

2.7. The Secretary of the Air Force, Office of Public Affairs (SAF/PA)

2.8. The Secretary of the Air Force for Acquisition, Technology & Logistics

(SAF/AQ)

2.9. The Administrative Assistant to the Secretary of the Air Force (SAF/AA)

2.10. The Secretary of the Air Force, Inspector General (SAF/IG)

2.11. The Office of the Secretary of the Air Force General Counsel (SAF/GC)

2.12. Secretary of the Air Force Chief Data Officer (SAF/CO)

2.13. Air Combat Command (ACC)

2.14. Air Force Materiel Command

2.15. Air Education and Training Command (AETC)

2.16. Air Force Academy

2.17. Commanders/Directors at all levels

2.18. Commanders at MAJCOMs, DRUs and Air Force Forces (AFFOR)

2.19. Commanders/Directors at Field Operating Agencies (FOA), Wings and Wing

Equivalent Organizations (e.g., Centers, Laboratories

2.20. Air Force OPSEC Program Manager is the appointed adviser to Air Force

Leadership regarding Air Force OPSEC

2.21. OPSEC Program Managers at MAJCOMs, DRUs and AFFORs

2.22. OPSEC Signature Managers at FOAs, Wings, and wing equivalent organizations’

(e.g. Centers, Laboratories)

2.23. OPSEC Planners

2.24. OPSEC Coordinators at all levels

4 AFI10-701 24 JULY 2019

2.25. Responsible Contracting Office

Chapter 3—OPSEC PROCESS 24

3.1. General

3.2. Identify Critical Information:

3.3. Analyze Threats:

3.4. Analyze Vulnerabilities:

3.5. Assess Risk:

3.6. Apply Countermeasures:

3.7. Signature Management

Chapter 4—OPSEC EDUCATION AND TRAINING 28

4.1. General

4.2. OPSEC Awareness Education:

4.3. Mission Oriented and Pre-Deployment OPSEC Awareness Education:

4.4. Air Force OPSEC Training

Table 4.1. Air Force OPSEC Training Requirements

Chapter 5—EVALUATING OPSEC 33

5.1. Overview

Table 5.1. OPSEC Reviews and Assessments

5.2. OPSEC Reviews

5.3. Assessments

5.4. Air Force OPSEC Support Team

Chapter 6—ELECTRONIC SYSTEM SECURITY ASSESSMENT (ESSA) 41

6.1. Overview

6.2. Purpose

6.3. Monitoring Authority

6.4. ESSA Request Priorities

6.5. Release of Monitoring Information

6.6. ESSA Products

6.7. Active Indicator Monitoring Products

AFI10-701 24 JULY 2019 5

6.8. Other Products

Chapter 7—OPSEC PLANNING 47

7.1. General

7.2. Incorporating OPSEC into Operational Planning

7.3. Incorporating OPSEC into Support Plans

7.4. Incorporating OPSEC into Exercise Planning

Chapter 8—OPSEC REQUIREMENTS WITHIN ACQUISITIONS AND CONTRACTING 50

8.1. Incorporating OPSEC into the Acquisitions and Contracting Process

8.2. Organizational Responsibilities

8.3. Document Reviews

Attachment 1—GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 52

6 AFI10-701 24 JULY 2019

Chapter 1

OPERATIONS SECURITY (OPSEC) OVERVIEW

1.1. National Security Decision Directive 298,National Operations Security Programrequires each executive department and agency with a national security mission to have an OPSEC program. Likewise, DoDD 5205.02E, DoD Operations Security (OPSEC) Program, supports the national program and requires each Department of Defense (DoD) component to establish and maintain an OPSEC program.

1.2. OPSEC is an information-related capability that preserves friendly essential secrecy by using a process to identify, control and protect critical information and indicators. If critical information and indicators are disclosed, it could allow adversaries or potential adversaries to identify and exploit friendly vulnerabilities leading to increased risk to mission failure or the loss of life. The desired effect of OPSEC is to influence the adversary’s behavior and actions by reducing the adversary’s ability to collect and exploit critical information and indicators about friendly activities.

1.3. Essential secrecy is the condition achieved by denying critical information and indicators to adversaries. Adversaries in possession of critical information can hinder or prevent friendly mission accomplishment. Thus, essential secrecy is a prerequisite for effective operations.

1.4. OPSEC, when closely integrated and synchronized with other information-related capabilities, security disciplines and all aspects of protected operations, preserves essential secrecy. OPSEC does this by systematically identifying and managing critical information and indicators attendant to military operations and activities, to deny an adversary the ability to interpret friendly intentions, capabilities, or activities in sufficient time to act effectively against friendly mission accomplishment. It is impossible to avoid all risk and protect everything.

Attempting to protect all information diverts resources from actions needed for mission success.

Instead organizations should seek an efficient and effective cost solution that balances their risk assessment against vulnerabilities and potential threats to their critical information and indicators.

1.5. OPSEC supports planning, preparation, execution and post execution phases of all activities, operations and programs across the entire spectrum of military operations. Enhanced operational effectiveness occurs when decision-makers apply OPSEC from the earliest stages of planning. Exclusion of OPSEC in the early stages of strategy and operational planning limits the effectiveness of operations and consequently degrades the commander’s ability to gain information superiority.

AFI10-701 24 JULY 2019 7

1.6. Commanders and directors are responsible for identifying and managing signatures associated with Air Force activities, capabilities, operations, and programs. Signatures can be managed by implementing and practicing good OPSEC. OPSEC will be integrated into all military functions such as military strategy, command and control, operational and tactical planning and execution, continuity of operations, Air Force specialized training, and military accession. OPSEC shall also be coordinated and integrated into all security disciplines such as cyber, information, industrial, personnel and physical, law enforcement, antiterrorism and force protection. In addition, OPSEC shall be integrated into relevant support activities; contingency;

combat and peacetime operations and exercises; communications/computer architectures and processing; critical infrastructure protection; science and technology efforts, weapons systems research, development, test and evaluation processes; inspections; acquisition and procurement;

and medical operations. (T-0). Note: Science and technology efforts and research, development, test and evaluation activities are high-priority targets for collection and are particularly vulnerable to compromise for both classified and unclassified information and have an inherent requirement to implement OPSEC.

1.7. OPSEC is a commander’s/director’s responsibility and is established, managed and implemented at all levels throughout the AF. It is an operations function and shall be integrated into all operational planning and coordinated with relevant information operations functions. (T-0).

1.7.1. To ensure effective implementation across organizational and functional lines of operations, the management of OPSEC should reside in the operations and/or plans element of an organization. For those organizations with no traditional operations or plans element, the commander/director determines the most logical organization to place management and responsibility of their OPSEC program.

1.7.2. The Air Force OPSEC program management structure consists of senior leadership oversight and OPSEC practitioners (program managers, signature managers, coordinators, planners, instructors and OPSEC Support Team members) at appropriate command levels as illustrated in Figure 1.1, Air Force Operations Security Organizational Structure.

Figure 1.1. Air Force Operations Security Organizational Structure.

1.7.3. An OPSEC program consists of policies, accountability, mechanisms for enforcement, operating staff, tactics, techniques and procedures, education, training and equipping functions necessary to enable the conduct of OPSEC planning and execution and to ensure the highest level of leadership oversight.

8 AFI10-701 24 JULY 2019

1.8. OPSEC is everyone’s responsibility. Air Force personnel at all levels will:

1.8.1. Be familiar with the organization’s critical information, indicators and threats. (T-0).

1.8.2. Protect critical information and indicators from disclosure. (T-0).

1.8.3. Protect all electronic communications containing critical information and indicators.

(T-0).

1.8.4. Not publicly disseminate, or publish information or imagery displaying critical information such as improvised explosive device strikes, battle scenes, casualties, destroyed or damaged equipment, personnel killed in action (both friendly and adversary) and the protective measures of military facilities or other critical information as identified by the critical information and indicators list within each organization. This prohibition extends to publishing sensitive information via social media and other internet-based capabilities without the appropriate level of oversight and approval. (T-0).

1.9. To enhance the effectiveness and understanding of OPSEC: The Air Force provides education and training for all Air Force personnel (e.g., military, Department of the Air Force civilians, DoD Contractors, family members). Additionally, the Air Force conducts internal and external assessments utilizing tools and capabilities such as the AF OST, Electronic Systems

Security Assessments (ESSA) and Enterprise Protection Risk Management (EPRM).

1.10. Ideally, the Air Force uses OPSEC countermeasures to protect its critical information. Failure to properly implement countermeasures can result in serious injury or death to Air Force personnel, damage to weapons systems, equipment and facilities, loss of sensitive technologies, and mission degradation or failure.

1.11. Air Force OPSEC SharePoint Sites. The Air Force maintains OPSEC SharePoint sites on both the Non-classified Internet Protocol Router Network and the Secret Internet Protocol

Router Network (SIPRNet). Air Force OPSEC practitioners request access to the SharePoint sites through their MAJCOM/DRU OPSEC Program Manager or the AF OST.

1.11.1. The SharePoint site https://cs2.eis.af.mil/sites/10054/default.aspx located on the

Non-classified Internet Protocol Router Network is the central location for unclassified collaboration of OPSEC. Examples of awareness briefings, training materials, potential communication technology threats and lessons learned are available on the SharePoint site.

1.11.2. The OPSEC SharePoint site located on SIPRNet

https://intelshare.intelink.sgov.gov/sites/signaturemanagement/SitePages/Home.aspx is the central storage and collaboration space for OPSEC at the SECRET level.

https://cs2.eis.af.mil/sites/10054/default.aspx https://intelshare.intelink.sgov.gov/sites/signaturemanagement/SitePages/Home.aspx

AFI10-701 24 JULY 2019 9

Chapter 2

ROLES AND RESPONSIBILITIES

2.1. Air Force Judge Advocate General (AF/JA).

2.1.1. Provides oversight and guidance on all legal matters pertaining to OPSEC assessments, procedures and activities.

2.1.2. Reviews and provides consultation regarding the use of OPSEC assessment derived information in disciplinary proceedings including courts-martial, non-judicial punishment and adverse administrative proceedings.

2.2. The Deputy Chief of Staff for Manpower, Personnel & Services (AF/A1). Responsible for policy and guidance of manpower, personnel, education, and training support to OPSEC.

AF/A1 ensures manpower assessments are conducted to determine appropriate manpower levels to accomplish OPSEC duties across the AF. (T-0).

2.3. The Deputy Chief of Staff for Intelligence, Surveillance and Reconnaissance

(AF/A2). Responsible for policy and guidance of intelligence support to OPSEC by providing integrated, evaluated, analyzed and interpreted information concerning foreign nations, hostile or potentially hostile forces or elements, or areas of actual or potential operations. Intelligence informs adversary actions, capabilities and intentions. AF/A2:

2.3.1. Provides foreign intelligence collection threat information support to Air Force

OPSEC. (T-0).

2.3.2. Provides written regional threat assessments in support of OPSEC. When this is not practical or possible, forward requirements through proper channels to the appropriate threat analysis center. Update written threat information as necessary, to include adversary collection means against an organization’s current situation and environment.

2.3.3. Provides threat assessments of current, updated and future modification, additions and technical capabilities of collection capabilities regarding Open Skies Treaty observation flights.

2.4. The Deputy Chief of Staff for Operations (AF/A3). Implements DoD and Joint Staff

OPSEC policy and establishes OPSEC guidance and procedures, through the Director of

Training and Readiness (AF/A3T). Directs the establishment of manpower, funding and resources to implement Air Force OPSEC.

2.4.1. Director of Training and Readiness (AF/A3T). Responsible for the development of

Air Force OPSEC policy, programs, guidance, OPSEC support capabilities and activities.

2.4.2. Establishes policy, oversight and resource advocacy for Air Force OPSEC and ESSA operations. (T-0).

2.4.3. Appoints a full-time OPSEC Program Manager charged with ensuring the Air Force plans, executes, resources and funds OPSEC consistent with Air Force activities and DoD policy. (T-0).

2.4.4. Provides the Deputy under Secretary for Defense (Intelligence) an annual assessment of Air Force OPSEC. (T-0).

10 AFI10-701 24 JULY 2019

2.4.5. Ensures threat-based comprehensive OPSEC assessments are conducted across the Air

Force every three years to evaluate and assess the effectiveness and efficiency of OPSEC.

Identifies, prioritizes, schedules and conducts OPSEC assessments to reduce risk to and enhance mission effectiveness. These assessments may include but are not limited to Air

Force weapons systems, research, development, test and evaluation, acquisitions, treaty verification, nonproliferation protocols, international agreements, force protection operations, special access programs, and activities that prepare, sustain, or employ military services over the range of military operations. (T-0).

2.4.6. Ensures the risk of exposure to critical information, alone or through the compilation of classified information is mitigated by providing OPSEC training and guidance for those using DoD Internet of Things, other Internet-based capabilities, emerging technologies, or developing information sharing environments accessible across the enterprise. (T-0).

2.4.7. Ensures the establishment and management of a capability to conduct ongoing OPSEC and communications security vulnerability analysis on automated information systems or applications and/or programs designed for net-centric interoperability for data aggregation

(e.g., component websites, SharePoint sites, email, radios, telephone and other communication systems and methods). (T-0).

2.4.8. Ensures the establishment and management of an OPSEC support capability to provide for OPSEC program development, planning, training, assessment, exercise, and operational support to AF activities, functions, missions, organizations and programs. (T-0).

2.4.9. Ensure policy and guidance is established and implemented directing deploying personnel to complete OPSEC training specific to their operating area. (T-0).

2.4.10. Ensures the establishment of the Air Force OPSEC Working Group. (T-0).

2.5. Deputy Chief of Staff, Logistics, Engineering and Force Protection (AF/A4). Ensures

OPSEC is implemented to protect the supply chain, design and testing to counter the threat to Air

Force operations and activities posed by foreign intelligence collection systems.

2.6. Secretary of the Air Force Deputy Chief Information Officer (SAF/CN).

2.6.1. Ensures OPSEC is included in cybersecurity and cyberspace policy, guidance and operational activities. (T-0).

2.6.2. Ensures OPSEC measures and practices are correctly reflected in the Air Force

Enterprise Architecture. (T-0).

2.6.3. Ensures OPSEC is incorporated into the development of net-centric operating environments to mitigate risks of classification through compilation of critical information and indicators. (T-0).

2.6.4. Ensures the Air Force has the capability to monitor, collect and analyze information from DoD electronic communications systems, to determine if any Air Force critical or classified information transmitted via unsecured and unprotected systems could adversely affect US (and allied/coalition) operations and activities. (T-0).

2.6.5. Establishes policy and guidance for notice and consent certification and related matters. (T-0).

AFI10-701 24 JULY 2019 11

2.7. The Secretary of the Air Force, Office of Public Affairs (SAF/PA).

2.7.1. Coordinates with the Air Force OPSEC Program Office, as required, to ensure appropriate OPSEC content is included in public affairs training and education. (T-0).

2.7.2. Ensures policy and procedures are established to ensure OPSEC reviews are accomplished within the Public Affairs Security and Policy Review process and that OPSEC considerations are integrated into information release processes. (T-0).

2.7.3. Provides policy and oversight of all content on official Air Force external-facing websites. (T-0).

2.7.4. Establishes and maintains on-going collaboration with information security, OPSEC and other relevant stakeholders, as required, to minimize potential OPSEC vulnerabilities while engaging with the public or media.

2.8. The Secretary of the Air Force for Acquisition, Technology & Logistics (SAF/AQ).

2.8.1. Ensures OPSEC is included in program protection plans to protect critical information and indicators throughout the life-cycle of Air Force acquisition and research, development, test and evaluation for critical program information reference AFI 63-101/20-101, Integrated

Life Cycle Management. (T-0).

2.8.2. Ensures acquisition, research, technology and OPSEC functions work together to protect critical information and indicators throughout the Acquisition Integrated Life Cycle framework. (T-0).

2.8.3. Ensures individuals who perform acquisition duties receive appropriate OPSEC training in support of program protection planning. (T-0).

2.9. The Administrative Assistant to the Secretary of the Air Force (SAF/AA). Provides coordination and integration of OPSEC policy, guidance and procedures within the Air Force security function.

2.10. The Secretary of the Air Force, Inspector General (SAF/IG).

2.10.1. Ensures OPSEC is inspected through the Unit Effectiveness Inspection in accordance with (IAW) AFI 90-201, The Air Force Inspection System.

2.10.2. Ensures the Air Force Office of Special Investigations (AFOSI) supports the

Commander’s or Director’s OPSEC responsibilities with counterintelligence activities and criminal investigation information to reduce the risk of adversary exploiting friendly forces critical information and indicators. (T-0).

2.10.3. Ensures AFOSI supports the AF OST with counterintelligence activities and criminal investigation information as requested to conduct threat-based comprehensive OPSEC external assessments. This support enhances the AF OST’s ability to reproduce the intelligence image in light of the known collection capabilities of potential adversaries against friendly capabilities and intentions.

2.11. The Office of the Secretary of the Air Force General Counsel (SAF/GC).

2.11.1. Provides oversight and guidance on all legal matters pertaining to ESSA procedures and activities.

12 AFI10-701 24 JULY 2019

2.11.2. Reviews and provides consultation regarding the use of ESSA derived information in disciplinary proceedings including courts-martial, non-judicial punishment and adverse administrative proceedings.

2.12. Secretary of the Air Force Chief Data Officer (SAF/CO).

2.12.1. Ensure OPSEC is included in enterprise data management policy, guidance, and operational activities. (T-0).

2.12.2. Ensure OPSEC measures and practices are reflected in Air Force Enterprise Data

Management activities. (T-0).

2.12.3. Ensure the collection of information is properly transmitted and collected according to OPSEC policy and guidance.

2.13. Air Combat Command (ACC). As the lead command for OPSEC will:

2.13.1. Manage OPSEC support within exercises and sourcing of request for forces.

2.13.2. Define and advocate for OPSEC resources.

2.13.3. Perform programming and budgeting for the OPSEC Program Elements.

2.13.4. Manage, develop and implement OPSEC Concept of Operations and tactics, techniques and procedures.

2.13.5. Establish, manage and maintain OPSEC education and training to meet AF, DoD and

Joint Staff OPSEC requirements.

2.13.6. Establish and provide travel funding for Air Force OPSEC training to Air Force personnel performing OPSEC duties.

2.13.7. Fund, as necessary, attendance at non-Air Force OPSEC training for Air Force personnel performing OPSEC duties.

2.13.8. Establish, resource, manage and maintain an OPSEC training capability to provide formal OPSEC training to Air Force OPSEC practitioners. The OPSEC training capability must:

2.13.8.1. Provide OPSEC training and mobile training teams as necessary.

2.13.8.2. Identify, train and recommend for certification additional Air Force OPSEC instructors as necessary.

2.13.8.3. Maintain Interagency OPSEC Support Staff adjunct instructor certification and course curriculum currency.

2.13.8.4. Support the development of OPSEC training and education.

2.13.8.5. Support Air Force and DoD-level OPSEC curriculum reviews as requested.

2.13.8.6. Support development of OPSEC policy and guidance for education and training.

2.13.8.7. Manage and provide student training data as necessary.

2.13.8.8. Coordinate with the AF OST regarding OPSEC-related trends obtained from

OPSEC assessments and incorporate into OPSEC curriculum.

AFI10-701 24 JULY 2019 13

2.13.8.9. Provide an annual report to Air Force OPSEC Program Manager regarding

OPSEC training activities accomplished during the fiscal year. (T-0).

2.13.9. Establish, resource, manage and maintain a vulnerability analysis capability to monitor, collect and analyze information traversing or residing on DoD electronic communications systems for OPSEC concerns. (T-0).

2.13.9.1. Coordinate and validate current and future monitoring, collection and analyzing requirements, processes and resources with the Air Force OPSEC Program Manager.

2.13.9.2. Ensure ACC/JA provides guidance pertaining to ESSA procedures and activities.

2.13.9.3. Provide annual report to Air Force OPSEC Program Manager regarding

OPSEC vulnerability assessment findings and trend analysis. (T-0).

2.13.9.4. Ensure ESSA support is provided to the AF OST.

2.13.10. Establish, resource, manage and maintain an effective OPSEC support capability.

(T-0). The OPSEC support capability will:

2.13.10.1. Manage and provide OPSEC reach-back support (e.g., education, planning, readiness training, assessments and operational support) to all Air Force organizations.

(T-0).

2.13.10.2. Manage and conduct OPSEC external assessments and OPSEC program management assessments to assist organizations in developing effective OPSEC programs. (T-0).

2.13.10.3. Assist in National, DoD, Joint and AF-level OPSEC activities as required.

2.13.10.4. Coordinate with cyberspace defense analysis organizations to receive ESSA products regarding the status of potential OPSEC disclosures discovered during cyberspace defense analysis operations.

2.13.10.5. Coordinate with cyberspace defense analysis organizations and the

Information Operations Formal Training Unit regarding trends observed from assessments for inclusion in future ESSA and OPSEC curriculum.

2.13.10.6. Assist in the development of OPSEC continuing education and training of the general Air Force population. (T-0).

2.13.10.7. Advise, evaluate and support research and development efforts for OPSEC tools supporting combatant commands. (T-0).

2.13.10.8. Ensure AF OST members complete the Air Force OPSEC Course within 90 days of appointment to OPSEC duties as outlined in chapter 4. (T-0).

2.13.10.9. Ensure AF OST members complete the Defense OPSEC Planners Course within 120 days of appointment to OPSEC duties as outlined in chapter 4. (T-0).

2.13.10.10. Support the Joint OPSEC Support Element in OPSEC activities as necessary.

2.13.10.11. Manage the Air Force OPSEC SharePoint sites.

2.13.10.12. Assist with the development and documentation of OPSEC related lessons-learned and tactics, techniques and procedures.

14 AFI10-701 24 JULY 2019

2.13.10.13. Provide annual report to Air Force OPSEC Program Manager regarding AF

OST functions identified in paragraph 2.13.10.1 (T-0).

2.14. Air Force Materiel Command. Air Force Materiel Command will integrate OPSEC into all research, development, test and evaluation programs to provide a consistent and effective level of protection throughout the life cycle of all weapon systems and capabilities. (T-0).

2.15. Air Education and Training Command (AETC). AETC will:

2.15.1. Ensure OPSEC training is provided in all Air Force accessions (e.g., Basic Military

Training School, Reserve Officer Training Corps and Officer Training School). At a minimum, the orientation will include the definition and purpose of OPSEC, threat awareness, vulnerabilities, countermeasures and the individual's role in protecting critical information. (T-0).

2.15.2. Incorporate OPSEC education into all professional military education. At a minimum, this will include the purpose of OPSEC, critical information, indicators, threats, vulnerabilities, countermeasures and the individual's role in protecting critical information.

(T-0).

2.15.3. Incorporate OPSEC concepts and capabilities into an Air Force Continuum of

Learning as presented in specialized courses, such as the Contingency Wartime Planning and

Joint Air Operations Planning Courses. These courses will include command responsibilities and responsibilities of OPSEC Planners supporting joint planning and execution efforts. (T-

1).

2.15.4. Establish a validation process in coordination with the Air Force OPSEC Working

Group to ensure a content review of all OPSEC training materials within all AETC accession and professional military education.

2.16. Air Force Academy. Will provide OPSEC education for all Air Force Academy accessions. At a minimum, OPSEC education will include the definition and purpose of OPSEC, threat awareness, vulnerabilities, countermeasures and the individual's role in protecting critical information. (T-0).

2.17. Commanders/Directors at all levels. The Commander/Director will:

2.17.1. Maintain essential secrecy of the Air Force activities within their enterprise and retain overall responsibility for risk management decisions and the implementation of OPSE countermeasures. (T-0). They must understand the risk to the mission and then approve countermeasures for implementation to mitigate said risk. (T-0). To achieve this end state commanders/directors will establish, resource and maintain effective OPSEC. (T-0). Note:

Commanders/Directors may delegate responsibility for the management of OPSEC to a level no lower than the A3 or appropriate Director for MAJCOM/DRU and Vice or Deputy

Commander/Director for Centers, Wings, Laboratories and wing-equivalent organizations.

2.17.2. Ensure personnel accomplishing duties as an OPSEC Program Manager, OPSEC

Signature Manager, OPSEC Planner, OPSEC Instructor, or OPSEC Support Team Member gain and maintain Top Secret access, are placed in Top Secret manpower billets and are eligible for Sensitive Compartmented Information. (T-2).

AFI10-701 24 JULY 2019 15

2.17.3. Ensure OPSEC Program Managers, OPSEC Signature Managers, OPSEC Planners, OPSEC Instructors, and OPSEC Support Team Members establish and maintain a SIPRNet account to have access to classified threat data and OPSEC tasks. (T-1). Note: Recommend

OPSEC Program Managers, OPSEC Signature Managers, OPSEC Planners, OPSEC

Instructors, or OPSEC Support Team members establish and maintain a Joint Worldwide

Intelligence Communication System account to access Top Secret-level threat information enhancing the development of effective countermeasures to mitigate risk to operational activities.

2.17.4. Ensure personnel conducting duties as an OPSEC Coordinator gain and maintain a

Secret clearance. (T-2). Recommend OPSEC Coordinators establish and maintain a

SIPRNet account to have access to classified threat data and OPSEC tasks.

2.17.5. Ensure potential OPSEC vulnerabilities are handled IAW the appropriate classification authorities and DoDI O-3600.02, Information Operations Security

Classification Guide. The DoDI O-3600.02 is located on the DoD Issuance website https://directives.whs.smil.mil on the SIPRNet.

2.17.6. Reports of potential OPSEC vulnerabilities will be sent in memorandum format to the MAJCOM or DRU OPSEC Program Manager using the appropriate network based on the classification of the information. (T-2).

2.17.7. Ensure procedures are established and implemented to conduct OPSEC reviews of contract documentation prior to public release. (T-0).

2.17.8. Ensure, when applicable, OPSEC requirements are properly reflected in government contracts.

2.17.9. Ensure OPSEC Working Groups are established and all members received the appropriate OPSEC training as identified in Chapter 4 of this instruction. (T-0).

2.17.10. Ensure OPSEC Working Groups are integrated with similar protection/security related working groups. (T-3).

2.18. Commanders at MAJCOMs, DRUs and Air Force Forces (AFFOR). Commanders will:

2.18.1. Ensure written guidance is issued to integrate OPSEC into day-to-day and contingency operations. (T-0).

2.18.2. Ensure coordination with other command-level organizations. (T-1).

2.18.3. Ensure measures are taken to manage signatures, prevent disclosures of critical information and indicators and maintain essential secrecy. (T-0).

2.18.4. Ensure critical information and indicators are identified and the risk assessed for each Air Force activity relating to the planning, development, deployment and movement of equipment, personnel, weapon systems and capabilities and document their mitigation efforts, whether the activity is planned, conducted, or supported. (T-0).

2.18.5. Appoint in writing a full-time primary and alternate OPSEC Program Manager. (T-

1).

https://directives.whs.smil.mil/

16 AFI10-701 24 JULY 2019

2.18.5.1. Ensure primary OPSEC Program Managers are appointed at grades no lower than O-4 or GS-13, for MAJCOMs and DRUs and O-3, E-7, or GS-11 for AFFOR Staffs.

(T-2).

2.18.5.2. Ensure alternate OPSEC Program Managers are appointed at grades no lower than O-2, E-7, or GS-11 for MAJCOMs and DRUs and O-1, E-6, or GS-9 for AFFOR

Staff. (T-2).

2.18.6. Ensure OPSEC Program Managers are appointed for no less than two-years for the

Air Force to optimize their training investment. (T-2).

2.18.7. Ensure DoD Contractors are not appointed as primary or alternate OPSEC Program

Managers. Note: DoD Contractors may be assigned as OPSEC analysts as long as there is government oversight. DoD Contractors may not accomplish inherently governmental functions. Inherently governmental functions are functions that are so intimately related to the public interest as to require performance by Federal Government employees. This means that contractors cannot make decisions that obligate the Federal Government. (T-0).

2.18.8. Establish billets for and designate within the command, based on mission requirements, OPSEC Planners at grades no lower than O-3, E-6, or GS-9. (T-2).

2.18.9. Appoint OPSEC Coordinators where it makes operational sense in the command’s directorates and special staff offices to implement and enhance the effectiveness of the command’s OPSEC Program and support the command’s OPSEC Program Manager.

Contractors may be assigned as an OPSEC Coordinator. Note: To reduce potential conflict of interest, prior to awarding a contract requiring a contractor to be an OPSEC Coordinator, consult the local contracting office to ensure there are no inherently governmental functions associated with the OPSEC Coordinator duties. (T-3).

2.18.10. Ensure OPSEC concepts are incorporated and institutionalized into relevant strategies, operations, plans, programs, budgets, exercises and training and evaluation methods. (T-0).

2.18.11. Ensure intelligence and counterintelligence organizations support the organization’s intelligence requirements such as providing classified threat reports, indoctrination to the intelligence activities of the organization and other activities necessary to integrate OPSEC into exercises and operational planning. (T-0).

2.18.12. Ensure contracting documents explicitly state the contractor’s OPSEC responsibilities and requirements to protect the critical information and indicators associated with the activity, operation or program being contracted. (T-0).

2.18.13. Ensure OPSEC Program Managers and Contracting representatives work together when writing requests for proposals, statements of work, performance work statements, statements of objectives or other contract documents to ensure mission critical information and indicators are not placed in unclassified contract documents. (T-2).

2.18.14. Ensure OPSEC education and training is provided as referenced in Chapter 4 for all assigned military, Department of the Air Force civilians and DoD Contractors. (T-0).

2.18.15. DELETED

AFI10-701 24 JULY 2019 17

2.18.16. Ensure annual internal OPSEC reviews and assessments are conducted as referenced in Chapter 5. (T-1).

2.18.17. Ensure subordinate organizational commanders/directors provide support as requested during AF OPSEC external assessments. (T-1).

2.18.18. Ensure annual OPSEC reviews of organizationally owned, operated or controlled external-facing websites and media sites are conducted to confirm critical information and indicators are not available to the public. (T-0).

2.18.19. Ensure OPSEC considerations are included in public affairs security policy review and all other public information release processes. (T-0).

2.18.20. Ensure the OPSEC Program Manager, Treaty Compliance Officer and Senior

Intelligence Officer, work together to identify and mitigate the risks associated with Open

Skies Treaty observation flights. (T-1).

2.18.21. Ensure a report detailing OPSEC risk assessment and mitigation efforts on Open

Skies Treaty observation activities within the commander’s/director’s enterprise is completed and made available upon request. (T-1).

2.18.22. Ensure an Annual OPSEC Report is completed, signed and forwarded to the appropriate higher headquarters OPSEC Program Manager as referenced in Chapter 5. (T-

0).

2.19. Commanders/Directors at Field Operating Agencies (FOA), Wings and Wing

Equivalent Organizations (e.g., Centers, Laboratories ). Commanders/Directors will:

2.19.1. Ensure measures are taken to manage signatures, prevent disclosures of critical information and indicators and maintain essential secrecy. (T-0).

2.19.2. Ensure coordination with the organization's command-level, other organizations and tenant(s) on the installation to ensure the protection of mission critical activities and capabilities. (T-0).

2.19.3. Appoint in writing a primary OPSEC Signature Manager at grades no lower than O-

3, E-7 or GS-12 and appoint in writing an alternate OPSEC Signature Manager at grades no lower than O-1, E-6 or GS-9. (T-2).

2.19.3.1. Ensure OPSEC Signature Managers are appointed for no less than two-years for the Air Force to optimize their training investment. (T-3). Note: Locations where the tour of duty is less than two years are exempt from the 2-year requirement.

2.19.3.2. Ensure DoD Contractors are not appointed as OPSEC Signature Managers. (T-

0).

2.19.4. Where it makes operational sense, appoint OPSEC Coordinators in the unit’s subordinate organizations and on the commander’s/director’s staff to implement and enhance the effectiveness of OPSEC within the organization and support the organization’s OPSEC

Signature Manager. Contractors may be assigned as an OPSEC Coordinator.

2.19.5. Organizations requiring contract support for OPSEC related activities must ensure contract requirements do not include the performance of inherently governmental functions and avoid or mitigate personal and organizational conflicts of interest. (T-0).

18 AFI10-701 24 JULY 2019

2.19.6. DELETED

2.19.7. Ensure critical information and indicators are identified and the risk assessed for each Air Force activity relating to the planning, development, deployment and movement of equipment, personnel, weapon systems and capabilities and document their mitigation efforts, whether the activity is planned, conducted, or supported. (T-0)

2.19.8. Ensure intelligence and counterintelligence organizations support the organization’s intelligence requirements such as providing classified threat reports, indoctrination to the intelligence activities of the organization and other activities necessary to integrate OPSEC into exercises and operational planning. (T-0).

2.19.9. Ensure annual OPSEC reviews and internal assessments are conducted. (T-2).

2.19.10. Ensure required support is provided to the AF OPSEC Support Team as requested during AF OPSEC external assessments. (T-1).

2.19.11. Ensure annual OPSEC reviews of organizationally owned, operated or controlled external-facing media sites are being conducted to confirm critical information and indicators are not being made available to the public. (T-0).

2.19.12. Ensure OPSEC considerations are included in Public Affairs Security Policy

Review and all other public information release processes. (T-0).

2.19.13. Ensure OPSEC education and training is provided as referenced in Chapter 4 for all assigned personnel (military, Department of the Air Force civilians and DoD Contractors).

(T-0).

2.19.14. Ensure contracting documents explicitly state contractor OPSEC responsibilities and requirements to protect critical information and indicators for the contracted activity, operation, or program. (T-0).

2.19.15. Ensure contract requirement owners coordinate with OPSEC Signature Managers, the contracting office and other stakeholders to ensure mission critical information and indicators are not placed in publicly available contract documents. (T-1).

2.19.16. Ensure OPSEC Working Groups are established as required and integrated with similar protection/security related working groups. (T-3).

2.19.17. Ensure the OPSEC Signature Manager, Treaty Compliance Officer and Senior

Intelligence Officer, work together to identify and mitigate the risks associated with Open

Skies Treaty observation flights. (T-1).

2.19.18. Ensure an Annual OPSEC Report is completed, signed and forwarded to the appropriate higher headquarters OPSEC Program Manager as referenced in Chapter 5. (T-

0).

2.20. Air Force OPSEC Program Manager is the appointed adviser to Air Force

Leadership regarding Air Force OPSEC. The Air Force OPSEC Program Manager will:

2.20.1. Develop, communicate and ensure implementation of standards, policies and procedures to protect the essential secrecy of Air Force activities, operations and programs.

(T-0).

AFI10-701 24 JULY 2019 19

2.20.2. Identify requirements and necessary resources for the effective implementation of

OPSEC. (T-0).

2.20.3. Review and assess the effectiveness and efficiency of Air Force OPSEC. (T-0).

2.20.4. Within 90 days of appointment, complete the required OPSEC IAW Chapter 4. (T-

0).

2.20.5. Identify, prioritize and request OPSEC assessments and provide oversight and advocacy as the focal point for Air Force OPSEC assessment capabilities. (T-0).

2.20.6. Participate in DoD and National OPSEC training and education reviews to identify

DoD and Federal OPSEC training requirements. (T-0).

2.20.7. Chair the Air Force OPSEC Working Group. (T-0).

2.21. OPSEC Program Managers at MAJCOMs, DRUs and AFFORs. OPSEC Program

Managers will:

2.21.1. Serve as the commander’s/director’s representative regarding OPSEC requirements and the point of contact for all OPSEC-related issues between the Air Force OPSEC Program

Manager, AF OST and the organization’s subordinate units. (T-1).

2.21.2. Maintain responsibility for OPSEC inherently governmental functions. (T-1).

2.21.3. Advise the commander/director on the identification and protection of the organization’s critical information and indicators. (T-1).

2.21.4. Establish, maintain, review and confirm at least annually, the currency of the organization’s critical information and indicators list and countermeasures. (T-0).

2.21.5. Annually, review and assess the effectiveness and efficiency of OPSEC within the organization, to include currency and effectiveness of subordinate organization’s procedures to control critical information and indicators. (T-0).

2.21.6. Participate in budget development activities to identify manpower, funding and resources to effectively implement and sustain the OPSEC program. (T-0).

2.21.7. Develop and monitor OPSEC program expenditures. (T-0).

2.21.8. Develop, implement, distribute and annually review the commander’s OPSEC guidance and procedures. (T-0).

2.21.9. Advise the commander/director on the placement of OPSEC Coordinators where they will have an operational impact in supporting the MAJCOM/DRU and AFFOR OPSEC

Program. (T-0).

2.21.10. De-conflict implementation of OPSEC countermeasures with other MAJCOMs, DRUs, and FOAs. (T-0).

2.21.11. Provide oversight, guidance and training to subordinate OPSEC practitioners and working group members as referenced in Chapter 4. Training shall include specific roles and responsibilities associated with the assigned OPSEC functions. (T-0).

2.21.12. Ensure all other OPSEC education and training is provided as referenced in

Chapter 4. (T-0).

20 AFI10-701 24 JULY 2019

2.21.13. Ensure unit specific OPSEC education materials are provided to organizations which require contract support within 30 days of award of a contract as referenced in

Chapter 8. (T-0).

2.21.14. Within 90 days of appointment, complete the required OPSEC training as referenced in Chapter 4. (T-0).

2.21.15. Chair the organization’s OPSEC Working Group. (T-0).

2.21.16. Establish and maintain Command-level OPSEC SharePoint websites. (T-2).

2.21.17. Establish and maintain an Enterprise Protection Risk Management user account.

(T-1).

2.21.18. Review and provide advice on the development of OPSEC Plans. (T-0).

2.21.19. Conduct Staff Assistance Visits as requested by subordinate units for OPSEC planning and assistance in operationalizing OPSEC. (T-2).

2.21.20. Manage the command’s AF OST and ESSA support requirements. (T-1).

2.21.20.1. Request ESSA Focused Look Assessments through Twenty-Fourth Air Force

(Air Force Cyber) as referenced in Chapter 5. (T-1).

2.21.20.2. Review ESSA products, determine levels of risk, assess impact and update countermeasures to affected activities as required. (T-0).

2.21.20.3. Ensure OPSEC education is provided to prevent reoccurrence of OPSEC disclosures. (T-0).

2.21.21. Review applicable contract documents to ensure critical information and indicators are not included in publicly available contract documents. (T-0).

2.21.22. Review after-action reports and lessons learned to determine how they apply to the mission and applicability for inclusion into future OPSEC courseware and the Air Force lessons learned database, as prescribed IAW AFI 90-1601, Air Force Lessons Learned

Program. (T-1).

2.21.23. Attend and participate as part of the AF OPSEC Working Group. (T-0).

2.22. OPSEC Signature Managers at FOAs, Wings, and wing equivalent organizations’

(e.g. Centers, Laboratories). OPSEC Signature Managers will:

2.22.1. Serve as the commander’s/director’s representative regarding OPSEC requirements and the point of contact for all OPSEC-related issues between their MAJCOM/DRU and

AFFOR OPSEC Program Managers and the organization’s subordinate units. (T-2).

2.22.2. Maintain responsibility for OPSEC inherently governmental functions. (T-0).

2.22.3. Advise the commander/director on the identification and protection of the organization’s critical information and indicators. (T-2).

2.22.4. Identify manpower, funding and resource requirements to the applicable

AF/MAJCOM/DRU OPSEC Program Manager. If applicable, develop and monitor OPSEC program expenditures. (T-2).

AFI10-701 24 JULY 2019 21

2.22.5. Advise the commander/director on the placement of OPSEC Coordinators where they will have an operational impact in supporting OPSEC. (T-3).

2.22.6. Within 90 days of appointment (365 days for traditional Guard and Reserve), complete the required OPSEC training as referenced in Chapter 4. (T-2).

2.22.7. Provide OPSEC education materials as referenced in Chapter 4. (T-0).

2.22.8. Establish, maintain, review and confirm at least annually, the currency of the organization’s critical information and indicators list and countermeasures. (T-2).

2.22.9. Annually, review and assess the effectiveness and efficiency of OPSEC within the organization, to include currency and effectiveness of subordinate organization’s procedures to control critical information and associated indicators. (T-0).

2.22.10. Ensure planning…