afi10-701.pdf

BY ORDER OF THE SECRETARY

OF THE AIR FORCE

AIR FORCE INSTRUCTION 10-701

8 JUNE 2011

Operations

OPERATIONS SECURITY (OPSEC)

COMPLIANCE WITH THIS PUBLICATION IS MANDATORY

ACCESSIBILITY: Publications and forms are available on the e-Publishing website at www.e-publishing.af.mil for downloading or ordering.

RELEASABILITY: There are no releasability restrictions on this publication.

OPR: AF/A3Z-CI, Information Operations

Division

Supersedes: AFI10-701, 18 October 2007

Certified by: AF/A3Z

(Maj Gen Bolton)

Pages: 40

This publication implements Air Force Policy Directive (AFPD) 10-7, Air Force Information

Operations. The reporting requirements in this publication have been assigned Report Control

Symbol (RCS) DD-INTEL(A)2228 in accordance with DoDD 5205.02, DoD Operations

Security (OPSEC) Program. It applies to all Major Commands (MAJCOM), Field Operating

Agencies (FOA), Direct Reporting Units (DRU), Air Force Reserve Command and Air National

Guard (ANG) organizations. This publication provides guidance for all Air Force personnel

(military and civilian) and supporting contractors in implementing, maintaining and executing

OPSEC programs. It describes the OPSEC process and discusses integration of OPSEC into Air

Force plans, operations and support activities. Refer recommended changes and questions about this publication to the Office of Primary Responsibility (OPR) using the AF Form 847, Recommendation for Change of Publication; route AF Forms 847 from the field through appropriate chain of command. Ensure that all records created as a result of processes prescribed in this publication are maintained in accordance with AFMAN 33-363, Management of Records, and disposed of in accordance with the Air Force Records Disposition Schedule (RDS) located at https://www.my.af.mil/afrims/afrims/afrims/rims.cfm. The use of the name or mark of any specific manufacturer, commercial product, commodity, or service in this publication does not imply endorsement by the Air Force.

SUMMARY OF CHANGES

This document has been substantially revised and must be completely reviewed. This updated instruction adds responsibilities for MAJCOMs, FOAs and DRUs (paragraph 1.4.8), Air Combat

Command (ACC) (paragraph 1.4.8), commanders (paragraph 1.4.15), requirement to budget, http://www.e-publishing.af.mil/ https://www.my.af.mil/afrims/afrims/afrims/rims.cfm

2 AFI10-701 8 JUNE 2011

acquire and distribute OPSEC awareness and education materials (1.4.15.8.2), OPSEC Program

Managers (PM), Signature Management Officers, Coordinators and Planners (paragraph 1.4.16) and all Air Force personnel (paragraph 1.4.17). Chapter 2 has been renamed Signature

Management and OPSEC Process has been moved to Chapter 4. OPSEC measures have been deleted from chapter 4 and are now reflected to read countermeasures (paragraph 4.6).

Acquisition planning has been removed from chapter 3, OPSEC Planning and placed within chapter 8, OPSEC Contract Requirements. OPSEC Awareness Education and Training has been moved to chapter 5, OPSEC Education and Training, and includes requirement to provide awareness information to AF family members. OPSEC assessments has been moved to chapter

6 and titled Assessments. Additions to chapter 6 include web site link to the OPSEC Core

Capabilities Checklists (paragraph 6.1.5), requirements regarding the assessment of information on AF public and private web sites (paragraph 6.5), and requirement to utilize the operations security collaborations architecture (OSCAR) tool for annual assessments (paragraph 6.6.4). Air

Force OPSEC annual awards is located in chapter 7 and chapter 8 includes information regarding

OPSEC as a requirement within government contracts.

Chapter 1—GENERAL 4

1.1. Introduction:

1.2. Operational Context:

Figure 1.1. OPSEC Functional Structure

1.3. Purpose:

1.4. Roles and Responsibilities:

Chapter 2—SIGNATURE MANAGEMENT 15

2.1. Signature Management

2.2. Wing or installation commanders will:

2.3. Signature Management Officer/Signature Management Non-Commissioned Officer will:

2.4. Signature Management Planning and Coordination

2.5. Exploitation Countermeasures (Refer to AFI 10-704, Paragraph 2

Chapter 3—OPSEC PLANNING 19

3.1. General

3.2. Operational Planning

3.3. Support Planning

3.4. Exercise Planning

3.5. Acquisition Planning

Chapter 4—OPSEC PROCESS 21

4.1. General:

AFI10-701 8 JUNE 2011 3

4.2. Identify Critical Information:

4.3. Analyze Threats:

4.4. Analyze Vulnerabilities:

4.5. Assess Risk:

4.6. Apply Countermeasures:

Chapter 5—OPSEC EDUCATION AND TRAINING 23

5.1. General

5.2. All Personnel:

5.3. OPSEC PMs/SMO/SMNCOs/Coordinators, Planners, Inspection Teams:

5.4. Joint and Interagency OSPEC Support:

Chapter 6—ASSESSMENTS 26

6.1. General:

6.2. Annual OPSEC Program Review:

6.3. Staff Assistance Visit (SAV):

6.4. Survey:

6.5. Web Content Vulnerability Analysis:

6.6. Support Capabilities:

Table 6.1. OPSEC Assessment Types and Support Capabilities

Chapter 7—AIR FORCE OPSEC ANNUAL AWARDS PROGRAM 31

7.1. General:

Chapter 8—OPSEC REQUIREMENTS WITHIN CONTRACTS 32

8.1. General:

8.2. Guidance and procedures:

Attachment 1—GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION 34

4 AFI10-701 8 JUNE 2011

Chapter 1

GENERAL

1.1. Introduction: OPSEC is a military capability within Information Operations (IO). IO is the integrated employment of three operational elements: influence operations (IFO), electronic warfare operations and network warfare operations. IO aims to influence, disrupt, corrupt, or usurp adversarial human or automated decision-making while protecting our own. IFO employs the military capabilities of military information support operations (MISO), OPSEC, military deception (MILDEC), counterintelligence operations, public affairs (PA) operations and counterpropaganda operations to affect behaviors, protect operations, communicate commanders’ intent and project accurate information to achieve desired effects across the operational environment. OPSEC’s desired effect is to influence the adversary’s behavior and actions by protecting friendly operations and activities.

1.2. Operational Context:

1.2.1. Operational Focus. The OPSEC program is an operations function or activity and its goals are information superiority and optimal mission effectiveness. The emphasis is on

OPERATIONS and the assurance of effective mission accomplishment. To ensure effective implementation across organizational and functional lines the organization’s OPSEC

Program Manager (PM), Signature Management Officer (SMO), or coordinator will reside in the operations and/or plans element of an organization or report directly to the commander.

For those organizations with no traditional operations or plans element, the commander must decide the most logical area to place management and coordination of the organization’s

OPSEC program while focusing on operations and the mission of the organization. Figure

1.2 illustrates the AF OPSEC functional structure.

Figure 1.1. OPSEC Functional Structure

AFI10-701 8 JUNE 2011 5

1.2.2. Operational effectiveness is enhanced when commanders and other decision-makers apply OPSEC from the earliest stages of planning. OPSEC involves a series of analyses to examine the planning, preparation, execution and post execution phases of any operation or activity across the entire spectrum of military action and in any operational environment.

OPSEC analysis provides decision-makers with a means of weighing how much risk they are willing to accept in particular operational circumstances in the same way as operations risk management allows commanders to assess risk in mission planning.

1.2.3. OPSEC must be closely integrated and synchronized with other IFO capabilities, security disciplines, and all aspects of protected operations (see references listed in

Attachment 1).

1.3. Purpose:

1.3.1. The purpose of OPSEC is to reduce the vulnerability of Air Force missions by eliminating or reducing successful adversary collection and exploitation of critical information. OPSEC applies to all activities that prepare, sustain, or employ forces during all phases of operations.

1.3.2. OPSEC Definition. OPSEC is a process of identifying, analyzing and controlling critical information indicating friendly actions associated with military operations and other activities to:

1.3.2.1. Identify those actions that can be observed by adversary intelligence systems.

1.3.2.2. Determine what specific indications could be collected, analyzed, and interpreted to derive critical information in time to be useful to adversaries.

1.3.2.3. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

1.4. Roles and Responsibilities:

1.4.1. Air Force organizations must develop and integrate OPSEC into their mission planning to ensure critical information and indicators are identified. At a minimum, the Air

Force will integrate OPSEC into the following missions: military strategy, operational and tactical planning and execution, military indoctrination, support activities, contingency, combat and peacetime operations and exercises, communications-computer architectures and processing, critical infrastructure protection, weapons systems, Research, Development, Test and Evaluation (RDT&E), Air Force specialized training, inspections, acquisition and procurement, medical operations and professional military education. Although the OPSEC program helps commanders make and implement decisions, the decisions are the commander’s responsibility. Commanders must understand the risk to the mission and then determine which countermeasures are required.

1.4.2. The Deputy Chief of Staff for Operations, Plans and Requirements

(AF/A3/5). The AF/A3/5 is the OPR for implementing DoD OPSEC policy and guidance.

This responsibility is assigned to the Director of Cyber and Space Operations (AF/A3Z).

AF/A3Z will:

1.4.2.1. Establish an AF OPSEC program focused on senior leadership involvement using the management tools of assessments, surveys, training, education, threat analyses, resourcing, and awareness that, at a minimum, includes:

6 AFI10-701 8 JUNE 2011

1.4.2.1.1. Assign a full-time AF OPSEC PM (O-4 or civilian equivalent).

1.4.2.1.2. Establish AF OPSEC support capabilities that provide for program development, planning, training, assessment, surveys, operational support, and readiness training.

1.4.2.1.3. Conduct annual reviews and validations of the AF OPSEC program as prescribed by DoD and AF policy/guidance.

1.4.2.1.4. Ensure OPSEC surveys are conducted for subordinate commands and agencies in order to enhance mission effectiveness and reduce risk.

1.4.2.2. Develop Air Force Departmental publications to define policy, guidance, responsibilities and authorities to establish the internal management processes necessary to carry out DoD policy/guidance. Provide copies of all current service OPSEC program directives and/or policy implementation documents to the Joint Staff J-3.

1.4.2.3. Support OPSEC programs at the national, DoD and Joint-level as necessary.

1.4.2.4. Centrally plan, program, budget and manage training for the Air Force OPSEC program.

1.4.2.5. Provide oversight and advocacy as the focal point for AF OPSEC assessment capabilities.

1.4.2.6. Ensure appropriate levels of standardized OPSEC training and education are established and provided to all AF personnel, to include civil service personnel, and to all contractors who have access to mission critical information.

1.4.2.7. Publish unclassified advisory tips and best practices aimed at educating service members and their families about the official and personal use of social networking sites and potential vulnerabilities exposed by posting military service-related information online.

1.4.2.8. Develop policy and guidance to ensure OPSEC requirements are properly reflected in classified and unclassified contracts.

1.4.2.9. Ensure OPSEC policy development activities are integrated through the Air

Force Security Policy and Oversight Board (AFSPOB).

1.4.3. Secretary of the Air Force Office of Information Dominance and Chief

Information Officer (SAF/CIO A6)

1.4.3.1. Ensures OPSEC principles are included in information assurance policy, guidance, and operational oversight.

1.4.3.2. Ensures OPSEC principles and practices are correctly reflected in the AF

Enterprise Architecture.

1.4.3.3. Ensure OPSEC is incorporated into the developing Net-centric operating environments to mitigate the risks of classification through compilation of critical information.

AFI10-701 8 JUNE 2011 7

1.4.4. The Secretary of the Air Force, Office of Public Affairs (SAF/PA) develops policy and guidance to ensure OPSEC is considered in the public affairs process for releasing information to the public.

1.4.5. The Assistant Secretary of the Air Force, Acquisition (SAF/AQ)

1.4.5.1. Develop policy and guidance to ensure OPSEC is considered in AF acquisition and RDT&E for critical information and critical program information (reference DoDI

5200.39, Critical Program Information (CPI) Protection Within the Department of

Defense).

1.4.5.2. Ensure Government contract requirements properly reflect OPSEC responsibilities and are included in contracts when applicable.

1.4.6. The Administrative Assistant to the Secretary of the Air Force (SAF/AA) provides coordination and integration of OPSEC policy and guidance through the AFSPOB.

1.4.7. The Secretary of the Air Force, Inspector General (SAF/IG) will

1.4.7.1. IAW AFPD 90-2, Inspector General—The Inspection System, AFI 90-201, Inspector General Activities, and this Instruction, assess and report on AF organizational

OPSEC programs for compliance, planning, and operational readiness when conducting assessments, inspections, and/or management reviews.

1.4.7.2. Include OPSEC as a critical compliance item for Operational Readiness

Inspection (ORI) and Unit Compliance Inspections (UCI) at all levels of command.

1.4.7.3. Provide results of OPSEC assessments, inspections, and/or management reviews to AF/A3Z, Directorate of Cyber and Space Operations.

1.4.7.4. Ensure inspection team members conducting assessments, inspections, and or management reviews on organizational OPSEC programs complete the required OPSEC training listed in Paragraph 5.3.2.

1.4.7.5. Through Air Force Office of Special Investigations (AFOSI), provide OPSEC

PMs/SMOs/Coordinators and commanders with AFOSI threat information at CONUS, OCONUS and deployed locations.

1.4.7.6. Provide HUMINT (Human Intelligence) Vulnerability Assessment support when possible for OPSEC vulnerability assessments.

1.4.8. Air Force MAJCOMs, FOAs, and DRUs will:

1.4.8.1. Implement AF OPSEC guidance to incorporate and institutionalize OPSEC concepts into relevant doctrine, policies, strategies, programs, budgets, training, exercising, and evaluation methods. At the base/installation level, FOAs and DRUs will comply with host MAJCOM and wing guidance.

1.4.8.2. Develop effective OPSEC programs IAW guidance issued by AF/A3Z.

1.4.8.3. Designate an organization as the OPR for OPSEC and appoint a full-time

OPSEC PM position (O-3/4 or civilian equivalent). This position should be placed within the operations or plans element (unless MAJCOM mission and/or structure requires otherwise) and serve as the POC for all OPSEC related issues between headquarters Air Force and the command. DRUs and FOAs may request an exemption to

8 AFI10-701 8 JUNE 2011

appointing a full-time OPSEC PM position by submitting a waiver signed by the commander to the AF OPSEC PM with justification for the request.

1.4.8.4. Ensure OPSEC PMs have at a minimum a secret clearance (recommend Top

Secret) and accounts established on the SECRET Internet Protocol Router Network

(SIPRNET) and the Unclassified but Sensitive Internet Protocol (IP) Router Network

(NIPRNET).

1.4.8.5. Enforce policy and issue guidance implementing supplements or other guidance as required.

1.4.8.6. Consolidate OPSEC requirements and submit them according to the AF capabilities based planning process (reference AFI 10-601, Capabilities-Based

Requirements Development).

1.4.8.7. Ensure subordinate organizations consistently apply and integrate OPSEC into day-to-day operations and/or other IO activities throughout the command.

1.4.8.8. Ensure all subordinate organizations are identifying critical information for each operation, activity and exercise whether it be planned, conducted or supported.

1.4.8.9. Ensure all subordinate organizations are controlling critical information and indicators.

1.4.8.10. Ensure all subordinate organizations plan, exercise and implement countermeasures as appropriate.

1.4.8.11. Program funds for OPSEC through established budgeting and requirements processes.

1.4.8.12. Ensure OPSEC considerations are applied in capabilities development and the acquisition process.

1.4.8.13. Ensure training of OPSEC PMs and planners is accomplished as soon as possible upon being appointed.

1.4.8.14. Whenever practical all OPSEC PM, SMO and OPSEC planner positions

(billets) are assigned the OPSEC special experience identifier (SEI) 9O or 234. All individuals performing OPSEC duties will be awarded SEI 9O or 234 when all requirements are met and approval granted by the commander and/or appropriate AFPC assignment managers. SEIs will drive future training allocations upon receipt of orders or upon assignment to organizations with SEI coded positions.

1.4.8.15. Develop and cultivate the intelligence and counterintelligence relationships necessary to support OPSEC programs.

1.4.8.16. Serve as the focal point for MAJCOM-level OPSEC assessments, surveys and support capabilities.

1.4.8.17. Ensure OPSEC considerations are included in annual reviews of AF unclassified public and private web sites and pages (including all AF public and private web sites hosted outside base firewalls) and in the approval process for posting new data to AF public and private web sites.

AFI10-701 8 JUNE 2011 9

1.4.8.18. Ensure assistance is provided to PA as needed to ensure OPSEC considerations are included in PA review and approval processes for publishing/releasing information to the public.

1.4.8.19. Forward MAJCOM annual program review report executive summary to include all reports from one level down for the fiscal year period of 1 Oct – 30 Sep to the

AF OPSEC PM (AF/A3Z-CI) NLT 15 November each year (See Paragraph 6.2).

1.4.8.20. Ensure OPSEC related briefings or presentations to be given outside the

MAJCOM are coordinated through the Air Force OPSEC PM, AF/A3Z-CI, prior to the presentation date.

1.4.8.21. Coordinate with the Air Force Experimentation Office to incorporate Air Force

OPSEC initiatives into Joint/Air Force experimentation, traditional and spiral development acquisition activities.

1.4.9. Air Combat Command (ACC) will:

1.4.9.1. Assume all duties as lead command for AF OPSEC program.

1.4.9.2. Organize, train, and equip assigned forces to plan and execute OPSEC in a theater of operations for Joint or combined operations in the roles of aerospace control, force application, force enhancement, and force support.

1.4.9.3. Develop, document, and disseminate OPSEC tactics, techniques, and procedures

(TTP) for the Combat Air Forces.

1.4.9.4. Integrate OPSEC into the Air and Space Operations Center (AOC) construct.

1.4.9.5. Develop, maintain, program for, and provide Air Force OPSEC initial qualification training.

1.4.10. Air Mobility Command (AMC) will:

1.4.10.1. Lead centralized management of OPSEC functions and the establishment and integration of OPSEC in Mobility Air Force operations.

1.4.10.2. Develop Mobility Air Force (MAF) OPSEC TTPs.

1.4.10.3. Integrate OPSEC into the AMC AOC construct.

1.4.10.4. Develop functional area and functional needs analysis for MAF and submit through the AF capabilities based planning process.

1.4.10.5. Centrally program for MAF OPSEC capabilities.

1.4.11. Air Force Materiel Command (AFMC) will ensure OPSEC is integrated into all

RDT&E efforts. When critical information or critical program information is involved, ensure OPSEC is applied as a protective measure throughout the life cycle of all weapon systems IAW DoDI 5200.39 and AFI 63-101, Acquisition and Sustainment Life Cycle

Management.

1.4.12. Air Education and Training Command (AETC) will:

1.4.12.1. Provide OPSEC orientation for all new Air Force accessions to include what

OPSEC is, its purpose, threat awareness, and the individual's role in protecting critical information.

10 AFI10-701 8 JUNE 2011

1.4.12.2. Incorporate OPSEC education into all professional military education. At a minimum, this will include the purpose of OPSEC, critical information, indicators, threats, vulnerabilities, and the individual's role in protecting critical information.

1.4.12.3. Incorporate OPSEC concepts and capabilities into specialized courses, such as the Contingency Wartime Planning Course, Joint Air Operations Planning Course, and the Information Operations Fundamental Application Course. These courses will include command responsibilities and responsibilities of OPSEC planners in Joint Forces

Command IO Cells and MAJCOMs.

1.4.12.4. Ensure OPSEC is addressed in all technical and specialty school programs.

1.4.12.5. Establish a validation process to ensure AF/A3Z-CI, reviews all AETC OPSEC training materials used in accession and professional military education.

1.4.13. US Air Force Academy will provide OPSEC orientation for all new Air Force accessions to include what OPSEC is, its purpose, threat awareness, and the individual's role in protecting critical information.

1.4.14. Academy of Military Science will provide OPSEC orientation for all new Air Force accessions to include what OPSEC is, its purpose, threat awareness, and the individual's role in protecting critical information.

1.4.15. Commanders and Directors will: NOTE: Wing and installation commanders will follow the additional guidance in Chapter 2, Signature Management.

1.4.15.1. Issue guidance regarding the establishment of OPSEC measures to all assigned personnel to ensure OPSEC is integrated into day-to-day and contingency operations.

Commanders may delegate authority for OPSEC program management, but retain responsibility for risk management decisions and the overall implementation of countermeasures. They must determine the balance between countermeasures and operational needs.

1.4.15.2. Appoint in writing a primary and alternate OPSEC PM, or coordinator and forward to the next higher headquarters (HHQ) OPSEC PM. OPSEC PMs will be assigned for a minimum of two years, or as area tour length dictates (remote tours only).

Organizations where an assignment is less than two years will request, in writing a waiver to their HHQ OPSEC PM.

1.4.15.2.1. Wing or installation primary OPSEC PMs will be an O-3 or above, civilian equivalent, or an E-7. The alternate OPSEC PM will be an E-6 or above, or civilian equivalent. Under no circumstances will contract personnel be appointed as a primary or alternate OPSEC PM. At a minimum, OPSEC PMs will have a secret clearance (recommend Top Secret).

1.4.15.2.2. OPSEC Coordinators can be officers, NCOs or civilian equivalent of any grade. OPSEC Coordinators will have a secret clearance.

1.4.15.3. Submit request through servicing MPF for award of SEI 9O or 234 as appropriate for individuals appointed as OPSEC PMs, or Coordinators who meet all qualifications.

AFI10-701 8 JUNE 2011 11

1.4.15.4. Ensure OPSEC is integrated into planning efforts to increase mission effectiveness. Ensure organizational planners are trained to incorporate OPSEC into all functional areas of plans.

1.4.15.5. Ensure critical information lists (CIL) are developed and procedures are in place to control critical information and associated indicators.

1.4.15.6. Ensure OPSEC is considered for all organizational contracts. (See Chapter 8)

1.4.15.7. Ensure there is a valid mission need to disseminate information publicly and that review procedures are implemented.

1.4.15.8. Develop, establish, and implement policies and procedures to deny adversaries the opportunity to take advantage of publicly available information, especially when aggregated.

1.4.15.8.1. Ensure the OPSEC program includes all personnel who may have potential access to critical information to include Airmen, DAF civilians, DoD contractors, and family members.

1.4.15.8.2. Budget for OPSEC awareness and education training promotional campaign incentives; budget, acquire, and distribute OPSEC education materials.

1.4.15.8.3. Ensure the OPSEC training program clearly communicates to all personnel that the command will consider for appropriate disciplinary action all failures to follow directed OSPEC measures and/or unauthorized disclosure of critical information.

1.4.15.9. Ensure OPSEC assessments are conducted annually to support operational missions.

1.4.15.10. Ensure OPSEC PMs and Coordinators integrate into or liaise with the information protection, force protection, antiterrorism, and threat working groups and if necessary establish a working group to address OPSEC concerns. In addition, an ad-hoc working group will be established for any large-scale operation or exercise. NOTE:

Refer to AFTTP 3-1.IO, Tactical Employment – Information Operations (U), Attachment

4 for additional guidance.

1.4.15.11. Ensure unit deployment managers add OPSEC awareness training as a mandatory requirement for deploying personnel.

1.4.15.12. Ensure all personnel such as, Web Site administrators, Webmasters, supervisors, public affairs specialists, OPSEC coordinators, PMs, SMOs, etc., who review information for public release complete OPSEC training focused on reviewing information that is intended for posting utilizing Internet-based Capabilities.

1.4.16. OPSEC PMs, Coordinators and Planners: NOTE: Wing and installation SMOs will follow the guidance in Chapter 2, Signature Management.

1.4.16.1. OPSEC PMs are assigned in writing at organizations above the wing/installation level. OPSEC PMs may be assigned to FOAs and DRUs depending on their size, need and organizational reporting chain.

12 AFI10-701 8 JUNE 2011

1.4.16.2. OPSEC Coordinators are assigned in writing at each subordinate organization below the wing-level. At the MAJCOM level, National Guard Bureau (NGB), FOAs, or

DRUs, OPSEC Coordinators will be appointed within HQ directorates, as appropriate.

1.4.16.3. OPSEC PMs, and Coordinators will:

1.4.16.3.1. Have at a minimum a secret clearance (recommend Top Secret for Wing level positions and higher). In addition, OPSEC PMs will have accounts established on SIPRNET.

1.4.16.3.2. Advise commander or director on all OPSEC and signature management related matters to include developing operating instructions, recommending guidance, and OPSEC measures. Review periodically (at a minimum annually) for currency and update as necessary.

1.4.16.3.3. Tenant organization OPSEC PMs and Coordinators will closely coordinate and integrate with host wing on any OPSEC or signature management initiatives and working groups. However, administrative oversight of tenant organization’s program still resides with its HHQ OPSEC PM.

1.4.16.3.4. Incorporate OPSEC into organizational plans, exercises, and activities.

1.4.16.3.5. Develop, implement, and distribute commander’s OPSEC guidance memorandums to include CILs, and follow up with new or updates to local or

MAJCOM supplements to AFI 10-701, Operations Security (OPSEC). Review periodically (at a minimum annually) for currency and update as necessary.

1.4.16.3.6. Ensure procedures are in place to control critical information and associated indicators. Review periodically (at a minimum annually) for currency and effectiveness.

1.4.16.3.7. Utilize assessment results to mitigate discovered vulnerabilities and aid organization OPSEC awareness efforts.

1.4.16.3.8. Work closely with PA, information protection, web administrators, and other officials designated by the commander who share responsibility for the protection and release of information to ensure critical information is protected.

1.4.16.3.8.1. Prior to submitting to PA, conduct for OPSEC concerns a review of organizational information intended for publication or release to the public. This could include, but is not limited to base newspapers, safety magazines, flyers, web pages, interviews, and information for news articles.

1.4.16.3.8.2. Answer questions, assist in the development of guidance, and provide advice to PA and other information-releasing officials concerning protecting critical information during reviews of public and/or private web pages.

1.4.16.3.9. Provide oversight and management of organization’s OPSEC education and training.

1.4.16.3.9.1. Ensure initial mission-oriented OPSEC education and awareness training is accomplished upon arrival of newly assigned personnel and then annually thereafter.

AFI10-701 8 JUNE 2011 13

1.4.16.3.9.2. Track initial and annual awareness training and report training initiatives via the annual OPSEC program report to the next HHQ OPSEC PM.

1.4.16.3.10. Coordinate, facilitate, and conduct annual OPSEC assessments such as surveys, annual program reviews and vulnerability assessments as listed in Chapter 6.

1.4.16.3.10.1. Coordinate with appropriate organizations to resolve/mitigate assessment findings as required.

1.4.16.3.10.2. OPSEC PMs will establish and maintain Operations Security

Collaboration ARchitecture (OSCAR) accounts.

1.4.16.3.11. Conduct and forward annual program review for the period of 1 Oct through 30 Sep each fiscal year to HHQ according to MAJCOM guidance.

1.4.16.3.12. OPSEC PMs will establish, train, and chair working groups to address

OPSEC or signature management concerns and to assist with planning and execution of OPSEC plans and signature management activities.

1.4.16.3.13. Conduct Staff Assistance Visits (SAV) as required or requested.

1.4.17. All Air Force Personnel: OPSEC is everyone’s responsibility. Ideally, the AF uses

OPSEC measures to protect its critical information. Failure to properly implement OPSEC measures can result in serious injury or death to our personnel; damage to weapons systems, equipment and facilities; loss of sensitive technologies; and mission degradation or failure.

OPSEC is a continuous process and an inherent part of military culture. Failure to implement directed OPSEC measures will be considered by commanders/directors for appropriate disciplinary action. OPSEC must be fully integrated into the execution of all Air Force operations and supporting activities. All AF personnel (active duty, reserve, ANG, Air Force civilians, and DoD contractors) will:

1.4.17.1. Be familiar with their organization’s critical information.

1.4.17.2. Protect critical and/or sensitive information from disclosure.

1.4.17.2.1. When publicly posting or publishing work-related information that potentially contains critical or sensitive information airmen are encouraged to solicit the advice of their immediate supervisor, security office and/or OPSEC

PM/SM/coordinator. This will aid in preventing disclosure of critical and/or sensitive information within the public domain. Personnel that do not know what information is critical to an organization cannot reasonably conclude that posting or publishing information will not result in an unauthorized disclosure.

1.4.17.2.1.1. This includes, but is not limited to letters, resumes, articles, electronic mail (e-mail), web site postings, web log (blog) postings, internet message board discussions, or other forms of dissemination or documentation.

1.4.17.2.1.2. Supervisors will provide guidance to personnel regarding critical and/or sensitive information to ensure it is not disclosed in public forums. Each organization’s OPSEC PM/SM/coordinator will advise supervisors on means to prevent the public disclosure of critical and/or sensitive information.

1.4.17.2.1.3. Encryption serves as one measure to protect critical or sensitive information transmitted over unclassified networks. Encrypt all e-mail messages

14 AFI10-701 8 JUNE 2011

containing critical information, OPSEC indicators, and other sensitive information. (AFI 33-119, Air Force Messaging Paragraph 6.1.2)

1.4.17.2.2. Do not publicly disseminate, or publish photographs displaying critical and/or sensitive information. Examples include but are not limited to: Improvised

Explosive Device strikes, battle scenes, casualties, destroyed or damaged equipment, personnel killed in action (both friendly and adversary), and the protective measures of military facilities.

1.4.17.2.3. Do not publicly reference, disseminate, or publish critical and/or sensitive information already compromised. This provides further unnecessary exposure of the compromised information and may serve as validation.

1.4.17.2.4. Actively encourage others (including family members and family readiness groups) to protect critical and/or sensitive information.

1.4.17.2.5. Destroy (burn, shred, etc.) critical and/or sensitive unclassified information no longer needed to prevent the inadvertent disclosure and/or reconstruction of this material.

1.4.17.3. Implement protection measures as ordered by the commander, director, or an individual in an equivalent position.

1.4.17.4. Know who their organization’s OPSEC PM and Coordinator is and contact them for questions, concerns, or recommendations for OPSEC or signature management related topics.

1.4.17.5. Consider attempts by unauthorized personnel to solicit critical and/or sensitive information as human intelligence (HUMINT) gathering and consider it a HUMINT incident.

1.4.17.5.1. AF personnel who have been involved in or have knowledge of a possible incident will report all facts immediately to the nearest supporting AFOSI office as required by AFI 71-101, Vol 4, Counterintelligence.

1.4.17.5.2. If these offices are not readily available, HUMINT incidents will be reported to the organization’s security manager or commander who will ensure that, without exception, reports are relayed as securely and expeditiously within 24 hours to the nearest AFOSI organization.

AFI10-701 8 JUNE 2011 15

Chapter 2

SIGNATURE MANAGEMENT

2.1. Signature Management. Signature management (SM) utilizes a process of profiling day-to-day observable activities and operational trends at installations and each of its resident units.

SM incorporates preparatory methodologies of OPSEC and MILDEC creating synergies and resource efficiencies for both the OPSEC and MILDEC wing/installation programs. These methodologies result in identified processes and details that can be used in efforts to defend or exploit operational profiles resident at a given military installation. Defense of operational profiles is accomplished by implementing protective measures to deny or mitigate adversary collection of critical information. Development of protective measures is often accomplished using MILDEC tactics, techniques and procedures (TTPs). The TTPs used for protection of operational profiles are collectively referred to as Deception in Support of OPSEC (DISO).

NOTE: The guidance in this chapter is intended for Signature Management personnel at the wing/installation level. The Signature Management Officer (SMO) and Signature Management

NCO (SMNCO) take on the responsibilities of the OPSEC and Military Deception (MILDEC)

PM.

2.1.1. Signature Management is administered through a wing or installation SMO/SMNCO.

An SMO/SMNCO can be appointed the primary or alternate wing or installation OPSEC PM.

When an air component commander’s MILDEC plan requires Air Force wings and installations to present specified observable activities, the air component commander’s

MILDEC planner will determine the actions required by the supporting unit(s) and will communicate those requirements to the SMO/SMNCO.

2.1.2. Signature management, OPSEC, and MILDEC are a commander's responsibility. The

SMO/SMNCO will define the local operating environment and capture process points that present key signatures and profiles with critical information value. This process, known as the Base Profiling Process (BPP), is the deliberate effort to identify functional areas and the observables they produce to contribute to the overall signature of day-to-day activities and operational trends. Once the BPP is complete, the results can be used to develop a wing level

CIL and identify key process points for potential protection or exploitation. This ultimately provides commanders several options to exploit or deny operational signatures to ensure mission effectiveness.

2.2. Wing or installation commanders will:

2.2.1. Appoint in writing a primary and alternate SMO/SMNCO who will function as the

OPR for all SM activities. The primary SMO will be an O-3 or above, or civilian equivalent.

The alternate SMO will be an E-6 or above, or civilian equivalent. Under no circumstances will contract personnel be appointed as a primary or alternate SMO/SMNCO. At a minimum, SMO/SMNCOs will have a secret clearance (recommend Top Secret) and have two years retainability in the position or as area tour length dictates (remote tours only).

Organizations requiring appointment of an SMO/SMNCO for less than two years will request, in writing, a waiver through their MAJCOM OPSEC PM from AF/A3Z-CI.

2.2.1.1. In the event that host and tenant organizations on a given installation are subordinate to different MAJCOMs, the host MAJCOM OPSEC PM will coordinate and

16 AFI10-701 8 JUNE 2011

document how SM using protective and exploitation countermeasures will be conducted on that installation.

2.2.1.1.1. All wings based on the installation, regardless of their MAJCOM affiliation, will have a SMO/SMNCO assigned. However, the host wing/installation

SMO/SMNCO will act as the lead for all SM activities. This agreement will be stipulated on a Memorandum of Agreement (MOA) and should carry the weight of each signatory Wing Commander on the MOA as the designated SMO/SMNCO executes their duties for the installation.

2.2.1.1.2. The substance of this arrangement will be documented and kept on file for every installation for which this condition applies and incorporated into MAJCOM supplements to this instruction. A copy of the MOA will be forwarded to the

MAJCOM OPSEC PM and AF/A3Z-CI.

2.2.2. Submit request through servicing MPF for award of special experience (SEI) 9O or

234 as appropriate for individuals appointed as SMO/SMNCOs who meet all qualifications as identified in the Air Force Officer and Enlisted Classification Directories.

2.3. Signature Management Officer/Signature Management Non-Commissioned Officer will:

2.3.1. Follow guidance in this instruction and when appointed/assigned for MILDEC, follow

AFI 10-704, Military Deception Program.

2.3.2. Advise the commander on all SM related matters, to include developing and recommending policy, guidance, and instructions. Review periodically for currency and update as necessary.

2.3.3. Use the base profiling process to develop and maintain a master checklist of all activities associated with the mission areas for the wing or installation (i.e., recall, mobility processing, aircraft generation, airlift load generation and marshaling, munitions, personnel and equipment deployment, etc.). The checklist will be modified, as required, to support tasks associated with supported commander’s requirements. Therefore, well-developed master checklists are mandatory.

NOTE: MAJCOM subordinate organizations below the air component level are NOT required to develop supporting MILDEC tabs (C-3A) to combatant command plans or supporting air component plans.

2.3.4. Develop and maintain a current commander approved CIL.

2.3.5. Implement SM execution checklists as directed or authorized by their wing or installation commander, MAJCOM OPSEC PM, or the supported air component commander, as appropriate.

2.3.6. Identify key personnel involved in the planning and execution of each of the major functional mission areas, and select subject matter experts (SMEs) who can assist in the development, exercising, and execution of the protective or exploitation countermeasures and activities. Grant access to SM material and plans on the commander's authority alone (this may be delegated to the SMO/SMNCO for expediency as determined by the commander).

AFI10-701 8 JUNE 2011 17

2.3.7. Work closely with antiterrorism, force protection, information protection, PA, web administrators, and other officials designated by the commander who share responsibility for the protection and release of information to ensure critical information is protected.

2.3.8. Answer questions, develop guidance and provide advice to PA and other information releasing officials concerning protecting critical information during reviews of public and/or private web pages.

2.3.9. Attend the Air Force Signature Management Course within 90 days of appointment or by the next available class. If scheduling conflicts exist, MAJCOM OPSEC PMs must document and ensure SMO/SMNCOs are scheduled for the next available course not to exceed 180 days. If training is not completed within 180 days, MAJCOM OPSEC PMs must request a waiver from AF/A3Z-CI.

2.3.10. Conduct SM exercises at the wing or installation as directed by the parent

MAJCOMs supplemental guidance.

2.3.11. Work with exercise evaluation teams to observe and evaluate mission profiles and signatures, as well as measures of effectiveness (MOE) and measures of performance (MOP) that assess the organizations ability to mitigate loss of critical information. Evaluate how organization personnel execute protection or exploitation measures. Any deficiencies or best practices will be submitted in after action reports and to the AF lessons learned database

(https://www.jllis.mil/usaf/) when applicable. Lessons learned will be used to develop tactics improvement proposals (TIPs) IAW AFI 10-204 and AFI 11-260.

2.3.12. Establish, train, and coordinate with the unit SM working group (SMWG) members to assist with planning and execution of SM activities.

2.3.13. Coordinate, facilitate, and serve as the focal point for all assessments in support of

SM activities such as surveys, annual program reviews, and vulnerability assessments as listed in Chapter 6.

2.3.14. Develop and forward annual program reviews/reports for the period of 1 Oct through

30 Sep each fiscal year to HHQ according to MAJCOM guidance.

2.4. Signature Management Planning and Coordination. NOTE: Ensure proper security guidelines are followed when planning and coordinating SM activities.

2.4.1. Submit SM exercise concepts and execution checklists to their MAJCOM for coordination (refer AFI 10-704 and the MAJCOM Supplement for more details).

2.4.2. Submit SM execution checklists supporting real-world operations to the appropriate tasking authority (e.g., supported air component commands or MAJCOM OPSEC PM).

2.4.3. For SM activities utilizing exploitation countermeasures that require implementation outside of the installation, coordinate with the host wing/installation MILDEC POC (refer to

AFI 10-704, Paragraph 2.4.3).

2.4.4. Request assistance from the intelligence organization at the next level of their administrative and/or operational chain of command when requiring intelligence that exceeds organic capability. Counterintelligence support will be requested from the unit's local

AFOSI detachment.

https://www.jllis.mil/usaf

18 AFI10-701 8 JUNE 2011

2.4.5. Organizations needing assistance from Air Staff will make their request through their

MAJCOM OPSEC PM.

2.5. Exploitation Countermeasures (Refer to AFI 10-704, Paragraph 2.4.3. for additional guidance).

AFI10-701 8 JUNE 2011 19

Chapter 3

OPSEC PLANNING

3.1. General. This chapter provides direction for planners at wings, Air Force Component

Headquarters (AFFOR and AOC) to integrate OPSEC into plans. Air Force forces can be under observation at their peacetime bases and locations, in training or exercises, while moving, or when deployed to the field conducting actual operations. OPSEC methodology provides systematic and comprehensive analysis designed to identify observable friendly actions that could betray intentions or capabilities. Therefore, OPSEC principles must be integrated into operational, support, exercise, and acquisition planning. All plans will be reviewed periodically to ensure currency and updated when required.

3.1.1. OPSEC PMs, SMO/SMNCOs, or Coordinators will assist organization planners to incorporate protection of critical information and indicators into supported operational plans

(OPLANS) and supporting plans. They will also assist exercise planners in developing master scenario events listings (MSEL) and MOP to train organization personnel in the application or execution of countermeasures (See AFDD 2, Operations and Organizations, for more information concerning MOE and MOP.

3.1.2. OPSEC Planners will follow guidance as outlined in AFI 13-1AOC, Volume 3, Operational Procedures-Air and Space Operations Center, and Chapter 3 of this document.

3.2. Operational Planning. OPSEC will be included in all OPLANs, concept plans

(CONPLANs), functional plans (FUNCPLANs), and operation orders (OPORDS), etc.. Planners will use existing TTPs to develop Tab C to Appendix 3 to Annex C to the OPORD or OPLAN.

The planning staff will identify critical information and OPSEC indicators from all functional areas requiring protection throughout each phase of the operation. Risk assessments will be used to identify applicable countermeasures to mitigate any unacceptable operational risks. MOP and

MOE will be developed for each OPSEC measure.

3.2.1. Operational planning is typically focused at the Air Force Component Headquarters

(AFFOR and AOC), with reach-back support outside the theater when appropriate. When planning duties are split, all responsible entities will integrate OPSEC into their planning efforts (see also JP 3-13.3, Operations Security, Chapter 3). As the supported organization, the theater AOC will resolve debates and provide general guidance.

3.3. Support Planning. Integrate OPSEC into all wartime and contingency plans as well as support plans, i.e., programming plans and in-garrison expeditionary site plans.

3.4. Exercise Planning. In order to enhance combat readiness and improve crisis response, OPSEC will be included in all exercise plans (EXPLANs). Specific OPSEC and/or signature management scenarios will be included in the exercise MSELs with MOE and MOP to assess the proficiency of functional planners to mitigate loss of critical information and organization personnel to execute countermeasures. Deficiencies or best practices will be submitted to the AF lessons learned database (https://www.jllis.mil/usaf/) when applicable to assist in the assessment of critical information being posting in public forums. Lessons learned will be used to develop tactics improvement proposals (TIPs) IAW AFI 10-204, Readiness Exercises and

After-Action Reporting Program, and AFI 11-260, Tactics Development Program.

https://www.jllis.mil/usaf

20 AFI10-701 8 JUNE 2011

3.4.1. OPSEC measures will also be employed during exercises to minimize observations of sensitive training activities by adversary surveillance and treaty verification activities.

3.5. Acquisition Planning. OPSEC requirements will be determined for all acquisitions and contractor-supported efforts beginning with operational capabilities requirements generation and continues through design, development, test and evaluation, fielding, sustainment and system disposal. When required to protect sensitive military operations, commanders will ensure

OPSEC requirements are added to contracts. Commanders will evaluate contractor-developed and proposed OPSEC programs for compliance with required standards.

NOTE: For more detailed planning instructions, refer to AFI 10-400 series publications.

AFI10-701 8 JUNE 2011 21

Chapter 4

OPSEC PROCESS

4.1. General: OPSEC is an iterative five-step process: 1) Identify critical information; 2)

Analyze threats; 3) Analyze vulnerabilities; 4) Assess risk; and 5) Apply countermeasures.

Although normally applied in a sequential manner the process during deliberate or crisis action planning, dynamic situations may require any step to be revisited at any time.

4.2. Identify Critical Information:

4.2.1. Critical information is a specific fact about friendly intentions, capabilities, and activities vitally needed by adversaries for them to plan and act effectively, so as to guarantee failure or unacceptable consequences for friendly mission accomplishment. The product of the first step in the OPSEC process is to record your critical information in a critical information list (CIL).

4.2.2. Critical information is best identified by the individuals responsible for the planning and execution of the organization’s mission. A working group or staff planning team can most effectively accomplish this task. Once a CIL is developed, commanders must approve the list and then ensure their critical information is protected and/or controlled.

4.2.3. Critical information will be identified at the earliest stages of planning an operation or activity and continuously updated as necessary to support mission effectiveness.

4.3. Analyze Threats:

4.3.1. A threat is an adversary with the capability and intent to undertake action detrimental to the success of program activities or operations.

4.3.2. The primary source of local threat information is your local AFOSI detachment. For mission related intelligence support, contact your local intelligence unit. Generic validated threat data is provided by the Defense Intelligence Agency via the OPSEC assessment tool, OSCAR.

4.3.3. Intelligence organizations analyze the threat through research of intelligence, counterintelligence, and open source information to identify who is likely to disrupt, deny, degrade, or destroy planned operations.

4.3.4. A threat assessment should identify adversaries, their goals, what they already know, their capability and intent to collect critical information, and potential courses of action.

4.4. Analyze Vulnerabilities:

4.4.1. A vulnerability exists when the adversary is capable of collecting critical information or indicators, analyzing them and then acting quickly enough to impact friendly objectives.

The vulnerability can be your procedures, a failure of traditional security, poor judgment…