Attachment_7_L&BP_Standard_Operating_Procedures_(2_May).pdf

Lessons and Best Practices Branch

Standard Operating Procedures

Lessons and Best Practices (L&BP) Branch ensures validated/approved lessons and best practices are disseminated to the CALL, Cyber COE subject matter experts (SMEs), Soldiers, instructors, training and capability developers, Cyber/Signal/EW SMEs and doctrine writers to assist with their applicable product development.

There is more than just a reevaluation of Soldier tasks required, a change in doctrine, organizational structure, systems training and additional personnel. Figure 1 briefly shows how the Lessons and Best Practices establishes a remedy after an observation. This L&BP is one of many observations collected during unit visits at the CTC’s or after unit deployments through post deployment collection visits (PDCV). They provide valuable insights to the health and welfare of the units.

Figure 1. Establishing remedies by lessons learned after observation

SECTION 1 LESSONS AND BEST PRACTICES BRANCH MISSION, PROCESS,

AND RESPONSIBILITIES

LESSONS AND BEST PRACTICES BRANCH MISSION

MISSION STATEMENT

Collect, analyze, disseminate and integrate approved lessons learned, best practices and tactics, techniques and procedures to the Army to enable continuous improvement of Signal, Cyberspace Operations, and Electronic

Warfare.

Key Tasks:

Collect observations (lessons learned, best practices, and TTPs) from operations and training events.

Analyze observations to identify gaps and trends.

Disseminate lessons learned information to help plan, prepare, and execute mission requirements.

Integrate lessons learned within training and operations to improve readiness and enhance operations.

Advice units on the latest lessons learned, best practices and TTPs based on DOTMLPF-P.

Chair the CCoE Lessons Learned Forum to develop solutions to identified gaps and trends.

End State

A diverse body of current L&BP is available to enable both the generating and operating force in support of unified land operations.

The L&BP analyst collects, analyzes, and integrates L&BP to the institutional and operational force. The L&BP analyst provides current and relevant invaluable L&BP and TTPs to improve mission command warfighting functions and mission command essential capabilities’. The L&BP Branch –

IAW AR 11-33, Army Lessons Learned Program (April 2016) captures, records, and disseminates

Cyber, Signal and EW Lessons and Best Practices throughout the Cyber COE, CALL and posts approved observations on JLLIS.

Applies the Army Enterprise Accreditation Standards (AEAS) 1, Criterion 1p (1) – 1p (12) Criterion

1p. Institution implements programs, policies, and procedures to effectively collect, analyze, disseminate and integrate, archive, and assess L&BP across DOTMLPF domains.

Provides briefings to the Cyber and Signal Courses at the Cyber COE. Derived from Criterion 1p.

Criterion 1p. Institution implements programs policies and procedures to effectively collect, analyze, validate, integrate, disseminate, archive, and assess lessons and best practices across DOTMLPF-P domains.

Understands and trains (through briefings) the lessons learned (L2) concepts as outlined in AR 11-33, and integrates collected and analyzed lessons learned, best practices and tactics, techniques and procedures (TTPs) into education and training.

Dedicated in collecting and providing L&BP for the development of Doctrine and Training based on the Cyber COE core competencies of Cyber/Signal/EW across DOTMLPF-P at the tactical, operational, and strategic levels.

Develops and updates a collection plan based on Cyber COE SME and leadership guidance.

Interviews units during their rotation at the CTCs: Joint Readiness Training Center (JRTC) and

National Training Center (NTC), pre/during/post deployments, operational exercises, unit post deployment collection visit (PDCV), home station training (HST), and key leader interviews (KLI).

Coordinates with a variety of entities to collect lessons learned, best practices and TTPs from the experiences of Soldiers at the CTCs, CALL Collection and Analysis Team (CAAT), FORSCOM

Mission Command Assessment Team (MCAT), Cybersecurity Assessment Team (CSAT), Intelligence Center of Excellence (ICoE) Lessons Learned – Cyber, Unit PDCV and various approved forums and events.

Represents the Cyber COE in the CALL Forum consisting of the Action Officer Working Groups

(AWOG), Council of Colonels (CoC), and the General Officer Steering Committee (GOSC), Secure

Video Teleconferences (SVTC) and Defense Collaboration Services (DCS).

Briefs L&BP Cyber COE training courses: Company Commander & First Sergeants Course –

Monthly, Signal Captains Career Course (SCCC)– Monthly, Basic Officer Leaders Course (BOLC) –

Monthly, Regimental NCO Academy (RNCOA) Senior Leaders Course/Advanced Leaders Course

(SLC/ALC) – Weekly, S6 Course – Quarterly, Initial Entry Training (IET) – Weekly, System

Integration Branch (SIB) – Weekly, Spectrum Managers Course – Quarterly, Warrant Officer Basic

Course (WOBC) – Monthly, Warrant Officer Advance Course (WOAC) – Monthly, Pre-Command

Course (PCC) – Quarterly, and US Army Reserve (USAR) and Army National Guard Professional

Military Education (PME) courses as requested.

Hosts the CCoE Lessons Learned Forum groups scheduled for FY18 dates and times are available on the Cyber COE L&BP Website https://lwn.army.mil/web/slls/home. Internal organizations Cyber

School and EW College, Signal School, CNCOA, CDID, TCM-Cyber, TCM EW, TCM TR, TCM NS, CAD, RID, Doctrine Division, and Cyber Battle Lab. External organizations include CIO/G6, FORSCOM G6, CECOM, TRADOC G6, ARCYBER and DAMO-CY

Coordinates with CTC’s (NTC and JRTC) for unit training rotation schedules, after action reviews

(AARs), TTPs, and L&BPs.

Coordinates with United States Army Reserve Component (USARC) staff and faculty to ensure it trains the lessons learned (L2) concepts and integrates collected and analyzed L&BPs into education and training.

Unresolved DOTMLPF-P issues are recommended to CALL ALLF through the CLLF if required.

Establishes and maintains a working relationship with deploying organizations to document L&BPs throughout their deployment when possible.

Maintains the Cyber COE Website presence https://lwn.army.mil/web/slls/home and Joint Lessons

Learned Information System (JLLIS) https://www.jllis.mil/apps/.

LESSONS AND BEST PRACTICES PROCESS

The Cyber COE Lessons and Best Practices Process consists of 5 Phases; Phase 1 – Event Opportunities, Phase

2 – Collection Event, Phase 3 – CLLF Action Officer Working Group, Phase 4 – CLLF Council of Colonels and

Phase 5 – CLLF General Officer Steering Committee. Figure 1 shows the Cyber COE Five Phase Process in accordance with AR 11-33, Army Lessons Learned Program.

PHASE 1 – EVENT OPPORTUNITIES

This phase focuses on gathering collection requirements and identifying the forums where the required information is gathered. Forums include, but are not limited to: Combat Training Centers, unit and Joint Exercises, Center for Army

Lessons Learned, Warfighter Exercises, Mission Command Training Program, Combined Arms Assessment Team, Command Post Exercise, Field Training Exercise, Home Station Training, Post Deployment Collection Visit, Key

Leader Interview, CEMA Support to Corps and Below, Cyber Quest, Tactical Signal Pilot, Army National Guard and

Army Reserve training exercises, Network Integration Evaluation, Conferences, Industry Engagement, Federal

Agencies, Academia, Army Forums, and RFIs. L&BP then contacts identified units to coordinate participation in selected forums. Gather requirements from CoE SMEs to drive collections.

PHASE 2 – COLLECTION EVENT

During this phase, analysts attend selected forums and collect observations in accordance with the collection plan.

Gathered information is then vetted, validated, and analyzed to determine DOTMLPF-P solutions. Identified gaps, solutions, and lessons learned topics are then prepared for the CLLF.

Figure 1. Cyber COE Five Phase Process

PHASE 3 – CLLF ACTION OFFICER WORKING GROUP

In this phase, the CLLF is hosted by the L&BP to present selected issues that will be appointed to an office of primary responsibility to work solutions culminating in a quarterly General Officer Steering Committee. Identified gaps and trends, Identification of topics and proposed OPR, Collection priorities for upcoming events and Battle rhythm update.

PHASE 4 – CLLF COUNCIL OF COLONELS

Hosted by Lessons and Best Practices, OPR provides brief of assigned topic in preparation for quarterly GOSC, guidance and recommendations from COC, next quarter topic nominations/recommendations, and battle rhythm update.

PHASE 5- CLLF GENERAL OFFICER STEERING COMMITTEE

Current GOSC issues for resolution, OPR presentation of assigned topic solution and way ahead recommendation, CG guidance for future topics and collection events, recommendations for identified gaps and trends to the ALLF, and Battle rhythm update

NOTE: AR 11-33, Army Lessons Learned Program (ALLP), establishes a system for the collection, analysis, achieving, and dissemination of observations, insights, and lessons; TTPs; after action reviews (AARs);

operational records; and lessons learned from actual Army operations, experiments, and training events. The

ALLP is the Army’s system for change based on direct guidance from the Army’s senior leadership as well as Army, joint, and DOD doctrine and planning publications that outline the capabilities and requirements of the current and future Army.

LESSONS AND BEST PRACTICES BRANCH RESPONSIBILITIES

The L&BP branch is proactive and documents lessons learned, best practices and TTPs, successes and challenges;

analyzing, processing, storing, and disseminating current and relevant information to the Cyber COE and community through JLLIS and the Cyber CoE L&BP website. The overall intent of the L&BP process is to provide the most current and relevant information to the institutional training (POIs and lesson plans) and the operational force (HST and CTC training) enabling continuous improvement of Cyber/Signal/EW Soldier training.

SECTION 2 – LESSONS AND BEST PRACTICES BRANCH ROLES AND

RESPONSIBILITIES

Figure 2. Lessons and best practices organization chart

LESSONS AND BEST PRACTICES, BRANCH CHIEF

The L&BP Chief is the lead for the Army’s Cyber, Signal, and EW Community. He is responsible for supervising and overseeing the collection of L&BPs based on the Cyber COE core competencies of Cyber, Signal, and EW as applied to DOTMLPF-P in accordance with AR 11-33, Army Lessons Learned Program, and the Army

Enterprise Accreditation Standards (AEAS). The L&BP Chief oversees and provides guidance in the implementation of the Cyber/Signal/EW JLLIS and L&BP Website. Oversees the publication of all products being produced by the branch. Specifically, the L&BP Branch Chief —

Oversees the planning and coordinating of the collection of L&BPs from actual military operations, CTCs, unit PDCV, FTX, CPX, Cyber/Signal/EW related forums, Army Lessons Learned Forums

(ALLF) Action Officer Working Group (AOWG), Council of Colonels (COC) and General Officer

Steering Committees (GOSC) and attends/hosts defense collaboration services (DCS) sessions.

Oversees and directs the Cyber Center of Excellence (CCoE) Lessons Learned Forum (CLLF) consisting of an AOWG, COC and GOSC quarterly.

Reviews and recommends Cyber/Signal/EW focus areas to leadership.

Coordinates externally with the CALL, Forces Command (FORSCOM) G6, MCAT & CSAT, ICoE

L2 and other L2 COEs.

Provides guidance and ensures L&BP regulations are communicated and followed.

Attends L&BP planning conferences as required.

Develops AARs on L&BP recommendations for Cyber/Signal/EW leadership review.

Oversees the final analysis of L&BPs, TTPs and considering the DOTMLPF-P impact on

Cyber/Signal/EW that may influence doctrine and training at the Cyber COE and throughout the Army in reference to Cyber, Signal, and EW.

Coordinates internally with Cyber/Signal/EW capability, materiel, and training developers, instructors, Cyber COE TCMs, Cyber/Signal School, Reserve and National Guard components as required to discuss collected observations and TTPs in the CLLF working group and their impact on DOTMLPF-

P.

Oversees the dissemination of approved L&BPs and TTPs to Cyber/Signal/EW organizations to enable continuous improvement of Cyber/Signal/EW Soldier training increasing the Army's preparedness to conduct current and future Cyber/Signal/EW operations.

Oversees the dissemination of current, relevant and approved L&BPs by ensuring their posted on the

JLLIS and L&BP Website.

Ensures L&BPs briefings are presented to Company Commander & First Sergeants Course – Monthly, SCCC – Monthly, BOLC – Monthly, RNCOA SLC/ALC– Weekly, S6 Course – Quarterly, IET –

Weekly, SIB – Weekly, Spectrum Managers Course – Quarterly, WOBC – Monthly, WOAC –

Monthly, PCC – Quarterly, and USAR PME courses as requested.

LESSONS AND BEST PRACTICES, GOVERNMENT LEAD

The L&BP Government Team Lead is the SME on L&BPs for the Army’s Cyber, Signal, and EW Community.

Represents the L&BP Chief at meetings, briefings and assumes the L&BP Branch Chief responsibilities and provides direction in the absence of the L&BP Branch Chief. He is responsible for managing the collection of

L&BPs based on the Cyber COE core competencies of Cyber, Signal, and EW as applied to DOTMLPF-P in accordance with AR 11-33, Army Lessons Learned Program, and the Army Enterprise Accreditation Standards

(AEAS). The GL oversees and provides guidance in the implementation of the Cyber/Signal/EW JLLIS and

L&BP Website. Provides L&BP guidance to the team as required. Responsible for providing topics and for the publication of the published semiannually and recommending articles for publication in the Army Communicator

Magazine, published quarterly. Specifically, the L&BP GL is responsible for—

• Planning and coordinating the collection of L&BPs from actual military operations, CTCs, unit PDCV, FTX, CPX, Network Integration Evaluation (NIE), Cyber/Signal/EW related forums, and attends/hosts defense collaboration services (DCS) sessions.

• Plans and directs the Cyber Center of Excellence (CCoE) Lessons Learned Forum (CLLF) consisting of an AOWG, COC and GOSC quarterly.

• Reviewing and recommending Cyber/Signal/EW focus areas to leadership.

• Coordinating externally with the CALL, Forces Command (FORSCOM) G6, MCAT & CSAT, ICoE

L2 and other L2 COEs.

• Providing guidance and ensuring L&BP regulations are communicated and followed.

• Attending L&BP planning conferences as required.

• Developing AARs on L&BP recommendations for Cyber/Signal/EW leadership review.

• Conducting final analysis of L&BPs, TTPs and considering the DOTMLPF-P impact on

Cyber/Signal/EW that may influence doctrine and training at the Cyber COE and throughout the Army in reference to Cyber, Signal, and EW.

• Coordinating internally with Cyber/Signal/EW capability, materiel, and training developers, instructors, Cyber COE TCMs, Cyber/Signal School, Reserve and National Guard components as required to discuss collected observations and TTPs in the Cyber COE CLLF working group and their impact on DOTMLPF-P.

• Disseminating of approved L&BPs and TTPs to Cyber/Signal/EW organizations to enable continuous improvement of Cyber/Signal/EW Soldier training increasing the Army's preparedness to conduct current and future Cyber/Signal/EW operations.

• Disseminating current, relevant and approved L&BPs by ensuring their posted on the JLLIS and L&BP

Website.

• Developing and ensuring L&BPs briefings are presented to Company Commander & First Sergeants

Course – Monthly, SCCC – Monthly, BOLC – Monthly, RNCOA SLC/ALC– Weekly, S6 Course –

Quarterly, IET – Weekly, SIB – Weekly, Spectrum Managers Course – Quarterly, WOBC – Monthly, WOAC – Monthly, PCC – Quarterly, and USAR PME courses as requested.

LESSONS AND BEST PRACTICES, GS-12

The L&BPs Civilian analyst is primarily responsible to the L&BP Chief and Government Team Lead to ensure the SOP is implemented within the branch. The civilian analyst provides guidance and oversight of the analysts at all events. Specifically, the civilian analyst is responsible for—

• Collecting, analyzing, validating, approving and disseminating Cyber/Signal/EW L&BP to include emerging concepts, capabilities, TTPs, technologies, and the evaluation of problem areas and possible solutions.

• Understanding Cyber/Signal/EW doctrine and providing current and relevant doctrinal changes to the

Cyber COE doctrine authors.

• Participating in L&BP collections in support of actual military operations, CTCs unit training rotations, HST, key leader interviews, unit PDCV, operational and field training exercises, leader training program, and Cyber/Signal/EW related forums.

• Assisting in developing after-action-reports and other L&BP documents.

• Coordinating with capability, materiel and training developer’s subject-matter-experts and other L&BP

COEs, active, reserve and National Guard components to discuss and address Cyber/Signal/EW observations, TTPs and best practices based on DOTMLPF-P.

• Coordinating with CT/SSB chief and provides support by collecting and validating current and relevant tasks from the operational units in support of the CT/SSB.

• Briefing the concept of L&BP and applies the AEAS - Understands and Trains Lessons Learned as a

Concept to IET, BOLC, SCCC, WOBC, WOAC, RNCOA SLC/ALC, Spectrum Managers course, S-

6 course, PCC, and USAR PME courses as required.

• Providing and updating the JLLIS and L&BP Website with supporting documentation.

• Consults with signal, cyberspace and EW SMEs to write articles, handbooks and graphic training aids (GTA) in reference to cyberspace, signal, EW and other documents as required.

• Developing and writing L&BP documents as required.

ANALYSTS

CYBER COE L&BP ANALYSTS

The L&BP Analyst understands Cyber/Signal/EW doctrine and provides current and relevant doctrinal changes to the Cyber COE doctrine authors. The L&BP Cyber COE Analyst is responsible for—

• Coordinate and liaise for cyberspace, signal, and EW collecting opportunities, training events, meetings, forums, and exercises.

• Coordinate with CALL and other Army collection teams beginning with the collection plan and development, continues with analysis/rewrite of observations, and finalizes the effort with the publication of appropriate reports.

• Collect, analyze, validate, approve and disseminate cyberspace, signal, and EW L&BP to include emerging concepts, capabilities, TTPs , technologies and the evaluation of problem areas and possible solutions.

• Identify and post on the Joint Lessons Learned Information System (JLLIS) a cyber, electronic warfare and signal observations from each event and identify in the trip report with JLLIS number.

• Understands cyberspace, signal, and EW doctrine and provides current and relevant doctrinal changes to the cyber center of excellence doctrine authors.

• Participate in lessons and best practice collections in support of actual military operations, combined training centers (CTCs) unit training rotations, home station training, key leader interviews, post deployment collection visit (PDCV), operational and field training exercises, leader training program, and cyberspace, signal, and EW related forums.

• Assist in developing after-action-reports and other lessons and best practice documents.

• Coordinates with capability, materiel and training developer’s subject-matter-experts and other L&BP centers of excellence, active, reserve and national guard components to discuss and address cyberspace, signal, and EW observations, TTPs and L&BP based on doctrine, organizational, training, materiel, leadership & education, personnel, facilities and policy (DOTMLPFP).

• Coordinate with critical task/site selection board chief and supports collecting and validating current and relevant tasks from the operational units in support of the CT/SSB.

• Brief the concept of L&BP and applies the Army enterprise accreditation standards 21 - Understands and Trains Lessons Learned as a Concept to Initial Entry Training (IET), Basic Officers Course

(BOLC), Signal Captain’s Career Course (SCCC), Warrant Officer Basic Course (WOBC), Regimental Noncommissioned Officers Academy (RNCOA) Senior Leader Course/Advance Leader

Course (SLC/ALC), Cyber and Electronic Warfare and Signal Officers Course (S-6).

• Provide and updates the L&BP website with supporting documentation.

• Document and analyze pertinent cyberspace, signal, and EW information and observations derived from both actual (i.e. combat, peacekeeping, training) operations, CTC operations and related forums to enable continuous improvement of Army Forces, increasing the Army’s preparedness to conduct current and future operations.

• Coordinate the integration of solutions to effect positive changes within Doctrine, Organization, Training, Materiel, Leadership, Personnel, Facilities, and Policy (DOTMLPFP) domains to better posture the Army to support Commanders’ mission requirements.

• Coordinate with CALL and other Army collection teams beginning with collection plan concept and development, continues with analysis/rewrite of observations, and finalizes the effort with the publication of appropriate reports.

• Assist in updating CALL cyberspace, signal, and EW-related products or documents.

• Use email, software and various word processing applications to develop products and coordinate with

CALL collection teams.

• Interface, coordinate and collaborate with Army proponents, units, DA Staff, and other Doctrine, Organization, Training, Materiel, Leadership, Personnel, Facilities, and Policy (DOTMLPFP) responsible agents to facilitate timely analysis and solution development on emerging L&BP issues by assisting responsible proponents.

• Support TDY travel requirements as the CCoE cyberspace, signal, and EW representative to CONUS

(OCONUS if required) locations for the purpose of collecting, analyzing information and observations derived from both actual military (i.e. combat, peacekeeping, training) operations and CTC operations, with the express purpose of collecting lessons and best practices, identifying gaps and TTPs.

• Support extended travel requirements as the CCoE cyberspace, signal, and EW representative on a

Collection and Analysis Team (CAAT) for the Center for Army Lessons Learned (CALL) to CONUS and/or OCONUS locations for the purpose of collecting, analyzing information and observations derived from both actual military (i.e. combat, peacekeeping, training) operations with the express purpose of collecting lessons and best practices, identifying gaps and TTPs.

• Have the experience and knowledge to coordinate and collaborate with Army proponents, units, the

DA Staff and other DOTMLPF-P responsible agents to facilitate timely analysis and solution development on emerging lessons and best practices issues by assisting responsible proponents.

• Consults with signal, cyberspace and EW SMEs to write articles, handbooks and graphic training aids

(GTA) in reference to cyberspace, signal, EW and other documents as required.

• Monitor appropriate web forums and media for cyberspace, signal and electronic warfare L&BP inquiries on unclassified and classified systems.

• Capture appropriate inquiries of L&BP (request for information) and prepare responses

• Provide web content updates to CCoE L&BP website

• Contribute to L&BP event collection plans based on DOTMLPF-P

• Monitor all L&BP information from all training centers, unit visits, joint and Army websites, and other centers of excellence websites that are pertinent to cyberspace, signal and electronic warfare.

• Collaborate with the CCoE Knowledge Management section to insure content is shared and accessible to L&BP Branch.

• Consults with signal, cyberspace and EW SMEs to write articles, handbooks and graphic training aids

(GTA) in reference to cyberspace, signal, EW and other documents as required.

NATIONAL TRAINING CENTER (NTC) ANALYST

The L&BP NTC Analyst is assigned to the NTC under a Memorandum of Understanding (MOU) between the

Cyber COE and the NTC. This analyst is responsible to provide subject matter expertise in Cyber, Signal, and

EW support to the NTC. Coordinates and liaise for Cyberspace, Signal, and EW training events, meetings, forums, and exercises. Specifically, the L&BP NTC Analyst is responsible for—

Support the assigned combat training center (CTC) in accordance with Memorandum of Understanding

(MOU) between the CTC and the Cyber Center of Excellence (CCoE) by providing subject matter expertise in cyberspace, signal and electronic warfare support.

Provide daily status reports (by email to L&BP Personnel) of integration with the rotational unit staff ( e.g. S6, Signal Company Commander, EWO, 255s, 25D), CTC staff (e.g. OPFOR, O/C trainers/teams, CECOM) and CTC visitors working on cyberspace, signal, and EW topics, issues, and visitors from upcoming rotational units.

Represent the CCoE at the CTC for the purpose of observing, collecting, and analyzing information derived from both actual military (i.e. combat, peacekeeping, training) operations and CTC unit training operations, with the express purpose of collecting lessons and best practices, identifying gaps, and observing TTPs.

Report weekly status to the Doctrine Division, L&BP Chief, Government and Contractor Lead by

COB every Friday to brief during the L&BP synchronization meeting.

Provide a final rotational training unit rollup after every rotation within 5 days after Final AAR.

Identify and post on the JLLIS a cyberspace, electronic warfare and signal observation from each rotation with 5 days after final rotation AAR.

Include short summary of posted JLLIS observations with JLLIS number in the final unit rollup.

Coordinate and liaise for cyberspace, signal, and EW training events, meetings, forums, and exercises.

Assist and provide over the shoulder coaching at the leaders training program (LTP) and during rotations in cyberspace operations planning considerations for building the division operations order and cyber annexes.

Assist LTP coaches and OC/Ts in cyber planning considerations for S6, Intel, Fires and Intelligence operations products during LTP, rotations and other cyber related matters.

Collaborate with the CTC observer, controller/trainers as required.

Provide input and assist in coordinating external support in obtaining realistic scenario cyberspace threat input for writing operations orders and vignettes.

Assist CTC operations group in planning exercise design in support rotations to include coordination with external agencies such as ARCYBER, FORSCOM, and TRADOC as required.

Collaborate with and assist soldiers from upcoming rotational units visiting CTC

Collaborate with stakeholders working on cyberspace, signal, and EW topics/issues visiting CTC

Assist and support CTC visit preparation of doctrine authors

Coordinate with CALL in reference to the cyber, signal and EW collection plan and development.

Collects LL, BP, and TTPs based on doctrine, organizational, training, materiel, leadership & education, personnel facilities, and policy (DOTMLPF-P).

Collect and disseminate cyberspace, signal, and EW LL, BP and TTPs to include emerging concepts, capabilities, technologies and the evaluation of problem areas and possible solutions.

Develops after action reports (AARs) and other L&BP documents as required.

Understands cyberspace, signal, and EW doctrine and provides current and relevant doctrinal changes to the CCoE Doctrine Branch authors.

Provides updates for the L&BP website with supporting documentation.

Document and analyze pertinent cyberspace, signal, and EW information and observations derived from both actual (i.e. combat, peacekeeping, training) operations, CTC operations and related forums to enable continuous improvement of Army Forces, increasing the Army’s preparedness to conduct current and future operations.

Coordinate the integration of solutions to effect positive changes within DOTMLPF-P domains to better posture the Army to support Commanders’ mission requirements.

Coordinate with CALL and other Army collection teams beginning with the collection plan concept and development, continues with analysis/rewrite of observations, and finalizes the effort with the publication of appropriate reports.

Assist in updating CALL cyberspace, signal, and EW-related products or documents.

Use email, software and various word processing applications to develop products and coordinate with

CALL collection teams.

Interface, coordinate and collaborate with Army proponents, units, DA Staff, and other Doctrine, Organization, Training, Materiel, Leadership, Personnel, Facilities, and Policy (DOTMLPF-P) responsible agents to facilitate timely analysis and solution development on emerging L&BP issues by assisting responsible proponents.

Consults with signal, cyberspace and EW SMEs to write articles, handbooks and graphic training aids

(GTA) in reference to cyberspace, signal, EW and other documents as required.

JOINT READINESS TRAINING CENTER (JRTC) ANALYST

The L&BP JRTC Analyst is assigned to the JRTC under an MOU between the Cyber COE and the JRTC. This analyst is responsible to provide subject matter expertise in Cyber/Signal/EW support to the JRTC. Coordinates and is the liaise for Cyber/Signal/EW training events, meetings, forums, and exercises. Specifically, the L&BP

JRTC Analyst is responsible for—

Support the assigned combat training center (CTC) in accordance with Memorandum of Understanding

(MOU) between the CTC and the Cyber Center of Excellence (CCoE) by providing subject matter expertise in cyberspace, signal and electronic warfare support.

Provide daily status reports (by email to L&BP Personnel) of integration with the rotational unit staff ( e.g. S6, Signal Company Commander, EWO, 255s, 25D), CTC staff (e.g. OPFOR, O/C trainers/teams, CECOM) and CTC visitors working on cyberspace, signal, and EW topics, issues, and visitors from upcoming rotational units.

Represent the CCoE at the CTC for the purpose of observing, collecting, and analyzing information derived from both actual military (i.e. combat, peacekeeping, training) operations and CTC unit training operations, with the express purpose of collecting lessons and best practices, identifying gaps, and observing TTPs.

Report weekly status to the Doctrine Division, L&BP Chief, Government and Contractor Lead by

COB every Friday to brief during the L&BP synchronization meeting.

Provide a final rotational training unit rollup after every rotation within 5 days after Final AAR.

Identify and post on the JLLIS a cyberspace, electronic warfare and signal observation from each rotation with 5 days after final rotation AAR.

Include short summary of posted JLLIS observations with JLLIS number in the final unit rollup.

Coordinate and liaise for cyberspace, signal, and EW training events, meetings, forums, and exercises.

Assist and provide over the shoulder coaching at the leaders training program (LTP) and during rotations in cyberspace operations planning considerations for building the division operations order and cyber annexes.

Assist LTP coaches and OC/Ts in cyber planning considerations for S6, Intel, Fires and Intelligence operations products during LTP, rotations and other cyber related matters.

Collaborate with the CTC observer, controller/trainers as required.

Provide input and assist in coordinating external support in obtaining realistic scenario cyberspace threat input for writing operations orders and vignettes.

Assist CTC operations group in planning exercise design in support rotations to include coordination with external agencies such as ARCYBER, FORSCOM, and TRADOC as required.

Collaborate with and assist soldiers from upcoming rotational units visiting CTC

Collaborate with stakeholders working on cyberspace, signal, and EW topics/issues visiting CTC

Assist and support CTC visit preparation of doctrine authors

Coordinate with CALL in reference to the cyber, signal and EW collection plan and development.

Collects LL, BP, and TTPs based on doctrine, organizational, training, materiel, leadership & education, personnel facilities, and policy (DOTMLPF-P).

Collect and disseminate cyberspace, signal, and EW LL, BP and TTPs to include emerging concepts, capabilities, technologies and the evaluation of problem areas and possible solutions.

Develops after action reports (AARs) and other L&BP documents as required.

Understands cyberspace, signal, and EW doctrine and provides current and relevant doctrinal changes to the CCoE Doctrine Branch authors.

Provides updates for the L&BP website with supporting documentation.

Document and analyze pertinent cyberspace, signal, and EW information and observations derived from both actual (i.e. combat, peacekeeping, training) operations, CTC operations and related forums to enable continuous improvement of Army Forces, increasing the Army’s preparedness to conduct current and future operations.

Coordinate the integration of solutions to effect positive changes within DOTMLPF-P domains to better posture the Army to support Commanders’ mission requirements.

Coordinate with CALL and other Army collection teams beginning with the collection plan concept and development, continues with analysis/rewrite of observations, and finalizes the effort with the publication of appropriate reports.

Assist in updating CALL cyberspace, signal, and EW-related products or documents.

Use email, software and various word processing applications to develop products and coordinate with

CALL collection teams.

Interface, coordinate and collaborate with Army proponents, units, DA Staff, and other Doctrine, Organization, Training, Materiel, Leadership, Personnel, Facilities, and Policy (DOTMLPF-P) responsible agents to facilitate timely analysis and solution development on emerging L&BP issues by assisting responsible proponents.

Consults with signal, cyberspace and EW SMEs to write articles, handbooks and graphic training aids

(GTA) in reference to cyberspace, signal, EW and other documents as required.

PUBLICATION SPECIALIST (PUBLICIST)

The L&BP Publication Specialist is responsible for creating, editing, and publishing L&BP products in accordance with appropriate regulations while maintaining a copy of all publications, periodicals, brochures, pamphlets, and other archived information. The Publication Specialist (Publicist) is responsible for—

Consulting with the L&BP Chief, NCOIC, and Analysts to write, edit, and proof read data for use in documents or sections of documents such as articles, procedures, specifications, special reports, and any other deliverables as required.

Ensuring documentation is accurate, complete, meets editorial specifications, and adheres to standards for quality, graphics, coverage, format and style.

Applying an understanding of the basic concepts, practices, and vocabulary relevant to the subject matter in an easily understandable language while maintaining the technical level of the relevant information provided.

Collaborating with the Army Communicator magazine editor for submission of L&BP

Cyber/Signal/EW articles.

Creating, maintaining, and managing content of the L&BP monthly Newsletter and the Cyber Bulletin, semi-annually.

WEB MODERATOR

Web Moderator is responsible for—

Monitoring appropriate web forums and media for Cyberspace, Signal and EW lessons and best practices inquiries on unclassified and classified systems.

Assisting in maintaining databases and information repositories of lessons and best practices information.

Capturing appropriate inquiries and prepare responses.

Providing web content updates of Cyber COE L&BP information.

Contributing to L&BP collection plans.

Developing a tracking system for inquiries from web-based forums and media.

Understanding and adapting L&BP to assist outlying units through the Websites.

Monitoring all L&BP information from all training centers, unit visits, joint and Army Websites, and other centers of excellence pertinent to Cyberspace, Signal, and EW.

Coordinating teleconferences/DCS/SIPERnet VTCs for L&BP (internal/external) meetings.

Scheduling the CLLF facilities (monthly) to include teleconference capabilities.

Developing a tracking system for all TDY events and analyst supporting the events.

Tracking and coordinating all CALL events.

Writing and tracking task orders.

Attending collection events as required.

SECTION 3- LESSONS AND BEST PRACTICES EFFECTIVE COLLABORATION

The L&BP analysts provide effective collaboration by providing the most current and relevant information to assist in sustaining and enhancing the Army's preparedness to conduct current and future Cyber, Signal, and

Electronic Warfare operations. The following Figure 3, illustrates the L&BP Effective Collaboration by the L&BP

Branch Analysts.

Figure 3. Lessons and best practices effective collaboration

JOINT LESSONS LEARNED INFORMATION SYSTEM

Joint Lesson Learned Information System (JLLIS) is the automated solution supporting implementation of the

Chairman of the Joint Chiefs of Staff Joint Lessons Learned Program (JLLP). JLLIS facilitates the collection, tracking, management, sharing, collaborative resolution and dissemination of lessons learned to improve the development/readiness of the Joint Force. The validated information also enables actionable DOTMLPF-P changes to improve joint and combined capabilities. The Army system of record for lessons learned is JLLIS

IAW AR 11-33.

The Cyber COE L&BP process is web-enabled through the JLLIS. The L&BP process provides all Cyber COE stake-holders: CDID, L&BP, Doctrine, Directorates, Training Developers, Instructors, TRADOC Capability

Managers, and QAO, a collaboration tool/platform to influence the collection plan development and to analyze

L&BP and trends identified from collection events. This process implements approved recommended changes through the Cyber COE and in our institutional training to meet the needs of the operational force.

CYBER CENTER OF EXCELLENCE LESSONS LEARNED FORUM

The Cyber Center of Excellence (CCoE) Lessons Learned Forum (CLLF) drives doctrine, organization, training, materiel, leadership and education, personnel, facilities and policy (DOTMLPF-P) solutions for identified gaps and trends of signal, cyberspace and electronic warfare (EW) operations through the analysis of observations.

This process will improve collaboration, communication, and coordination during the analysis of L&BPs, trends, training gap identification and implementation/inclusion in products, processes, and institutional training across the Cyber COE.

The CLLF increases the effectiveness of operational signal, cyberspace, and EW forces by assisting CCoE capability developers and training developers with relevant and timely feedback and potential solutions based on collected observations. The CLLF validates and analyzes observations that lead to the identification of possible capability gaps and trends in signal, cyberspace, and EW operations. Using these gaps and trends, the CLLF proposes actionable near-term DOTMLPF-P solutions and assigns responsibility to a stakeholder as the office of primary responsibility (OPR) within the CCoE. The CLLF provides approved lessons learned; best practices;

and tactics, techniques and procedures (TTP) to the Signal School, Cyber School, and CCoE Noncommissioned

Officer Academy (CNCOA) to update programs of instruction and lesson plans. The CLLF informs the operational force on approved lessons learned, best practices, and TTPs. For solutions that require support from outside the CCoE, the CLLF proposes identified gaps and trends to the Army Lessons Learned Forum (ALLF) hosted by the Center for Army Lessons Learned (CALL).

CLLF stakeholders internal to the CCoE include Signal School, Cyber School, CNCOA, Office of the Chief of Signal, Office of the Chief of Cyber, and CDID. CDID subordinate stakeholders include all TRADOC

Capability Managers (TCM), Concepts and Analysis Division (CAD), Requirements Integration Division

(RID), Doctrine Division, and Cyber Battle Lab (CBL).

CLLF stakeholders external to the CCoE include United States Army Cyber Command (ARCYBER); Army

Chief Information Officer/G6; United States Army Communications-Electronics Command (CECOM);

Department of the Army, Military Operations Cyber Directorate (DAMO-CY); FORSCOM G6; and TRADOC

G6.

CRITICAL TASK/SITE SELECTION BOARD

The Cyber L&BP analysts collaborates with the Critical Task / Site Selection Board (CT/SSB) to provide current and relevant information in support of the upcoming CT/SSB. L&BP has reached out to the training developers and instructors to attend PDCV to collect job analysis and provide task surveys in support of their specific

CT/SSB. The L&BP branch can also provide validation of identified individual and collective tasks 6-8 months out to scheduled CT/SSB to provide current and relevant information for consideration for the critical tasks being considered by the CT/SSB voting members.

LESSONS AND BEST PRACTICES BRIEF

The Cyber L&BP analysts provide a briefing to the students during each of the courses; each briefing is catered to each particular course. The content of the brief given to the BOLC course is not the same when briefed to the

S6 course or the Regimental Noncommissioned Officer Academy - Advance Leaders Course/Senior Leaders

Course. The briefing addresses the lessons learned concepts as outlined in the Army Enterprise Accreditation

Standards (AEAS), AR 11-33, Army Lessons Learned Program and the Cyber COE LL Five Phase Process.

SECTION 4 – LESSONS AND BEST PRACTICES DISSEMINATION

LESSONS AND BEST PRACTICES INTERNAL DISSEMINATION

L&BP coordinates internally and disseminates information within the Cyber COE Soldiers, instructors, training and capability developers and Signal subject matter experts (SMEs) through L&BP briefings at each of the

Cyber/Signal/EW courses taught at the institutional Cyber/Signal/EW Schools.

COLLECTION PLAN DEVELOPMENT

The collection plan is developed in coordination with the Cyber COE SMEs (Cyber/Signal/EW SMEs, branch chiefs, training developers, instructors, combat developers (CDID, RID, and TCMs) and Cyber, Signal, and EW

SME, QAO, and KM during the observations community of practice working group. The collection plan is developed used to observe a CTC rotation, PDVC, unit exercise (FTX, CPX) or home station training etc. The

L&BP Analyst coordinates with CALL, FORSCOM, and the unit based on the collection plan requirements.

L&BP BRIEFINGS TO CYBER/SIGNAL/EW COURSES

L&BPs analysts provide a briefing of current and relevant information to the Cyber CoE institution Signal courses when requested by the course chiefs/departments. The following depicts the frequency of the courses briefed, dates and times are controlled by the course chief and are provided to L&BP as a calendar invite. Dates and times fluctuate.

• Individual Entry Training –Weekly.

• Systems Integration Branch (SIB) – Weekly.

• Regimental Noncommissioned Officer Academy – (ALC/SLC) – Weekly.

• Signal Career Captains Course – Monthly.

• Basic Officers Leader Course – Monthly.

• Commander/First Sergeant Course – Monthly.

• Warrant Officer Basic and Advance Course – Monthly.

• S6 Course – Quarterly.

• Pre Command Course (PCC) – Quarterly.

• 80TH TNG ARNG/RC (ALC/SLC) – Quarterly.

• Army Reserve/National Guard Units – Calendar Invite

LESSONS AND BEST PRACTICES EXTERNAL DISSEMINATION

CENTER OF ARMY LESSONS LEARNED (CALL) ARMY LESSONS LEARNED FORUM

L&BP branch coordinates externally by being a participant of the CALL Army Lessons Learned (L2) Forum. The

Secretary of the Army approved the Army L2 Forum on 2 Aug 11 and designated Commanders FORSCOM, TRADOC and AMC as co-chairs. TRADOC is the designated lead with the Center for Army Lessons Learned

(CALL) as facilitator. Over time the name has been simplified to the Army Forum.

The Army Forum is established and governed by DA EXORD 102-12 (DTG 131817ZApr12) which establishes minimum Army active participation by FORSCOM, TRADOC, AMC, ARSTAF, ASCCs, Centers of Excellence, Combat Training Centers, and AWG.

The Army L2 Forum is a venue where senior leaders can actively exchange time sensitive information and rapidly address operational commander issues, quickly disseminate solutions and allocate resources, and direct integration of L&BP into training, doctrine and combat developments to institutionalize what has been learned.

The Army L2 Forum rapidly identifies and accepts issues submitted by other forums across the Army they cannot resolve (e.g., Corps BCT Warfighters’ forums, COE Knowledge Networks, etc.). Due to senior leader involvement, the Forum facilitates accelerated adaptation of DOTMLPF-P solutions as well as L&BP and TTPs.

The Forum addresses issues that span the levels of war and the operating and generating forces to enable continuous improvement for the Army.

The Lessons and Best Practices Branch is a regular participant and represents the Cyber COE (Signal School, Cyber School, and Electronic Warfare) in the Army Lessons Learned Forum weekly. The ALLF on Wednesday’s will consists of an Action Officer Working Group or Council of Colonels. The GOSC will be scheduled on a

Friday. Date and times of the Army LL Forum is posted on the L&BP website and send out as an invite to all participating organizations as a calendar invite weekly. Below is an example of the ALLF LL Forum Battle

Rhythm of events.

SECTION 5 – TRIP REPORTS / SIGACTS ENTRY

Trip reports are due within 3 days after a TDY to the L&BP Chief and Government Team Lead. The following example is the current format that will be used when submitting your trip report.

TRIP REPORT EXAMPLE

DOCD Trip Report

Date Submitted: 06 March 2017

Subject: Cyber Blitz 17-1 Mid Planning Meeting

Traveler(s): COL Mark Parker

Travel Date(s): 27 Feb – 3 Mar 2017

Travel Location(s): Aberdeen Proving Ground

Persons Contacted: Dr. Mike Brownfield, CERDEC

Purpose/ Scope

Background/Discussion/Key Take Aways

Cyber Blitz 17-1 is a live, virtual and constructed event that will take place in multiple locations (APG and Joint

Base McGuire-Dix-Lakehurst) from 1-19 May 2017. Purpose of CB 17-1 is to support the acquisition life cycle and to inform TRADOC. CERDEC uses CB to conduct science and technology (S&T) experiments that focus on reducing risk for current/future S&T investments while providing an opportunity to support partner missions across the Army.

Representatives from 23 separate Army organizations participated in the weeklong event.

During the mid-planning meeting, CERDEC provided an overview of CB 16, and proposed objectives and purposes for CB 17-1.

CB 17 -1 will focus on the interim BCT in the 2022-2025 time period with future iterations of CB incorporating an expeditionary cyber team and fighting untethered.

During the meeting, the group worked on learning objectives, threat, vignettes, composition of 25 th ID BCT

TOC, network, etc.

DOCD provided learning objectives that will assist us in validating what is in FM 3-12 and will help assist us in refining the document for future publications.

Testing new capabilities is not an objective of CB (CERDEC does this without the need of CB)

CB 17-1 will leverage JRTC products to use in orders, background, map overlays, units, countries, etc.

CB 17-1 begins in Phase III

Discussion of whether a BCT should have the ability to execute OCO. No definitive answer from the group.

Many divided on this topic

Problem(s)/Challenge(s) Encountered and Recommended Solution(s)

No decision on whether the TOC will be TS-SCI or if the BISE will be split out. Decision will be made based on the 25th ID personnel and their clearance level. Should not be a big issue as there are not many platforms that will be present that operate at the TS-SCI level.

No Prophet for exercise. Not sure how EWPMT will receive sensor information. Still discussing this issue.

DAMO CY made a few comments that were new to many people:

Adding a 35 series NCO to the CEMA section

Information Operations as the lead for Information Dominance – possibly leading the integration of non-lethal efforts at the BCT. Impact to CEMA section leading these efforts?

Looking at having a 17A and 17B at some BCTs. Depends on their mission.

Where should the Soldiers from the CEMA section work from? Multiple opinions on this topic. This was answered with it depends on the unit. Some work out of the plans, and CUOPS, some work out of the BICES.

This will be key to look at during CB to see if there is a preferred breakout.

Required Follow-On/Tasks/Feedback Response(s)

Vigilant Pursuit: Platform to the Prophet that CERDEC is developing based on an ONS. TCM EW and TCM

Cyber should be familiar with this program, and if not, should become familiar with it. I can provide a POC if needed.

Way Ahead and Future Support Required

DOCD with continue to participate in CB 17-1 planning meetings and execution of CB17-1.

POC: COL Mark S. Parker

Phone: 706-791-9196

Email: mark.s.parker12.mil@mail.mil

SIGACTS ENTRY EXAMPLE

Topic: Cyber Shield Exercise (Army National Guard) (5 May 2017)

Discussion: Cyber CoE Lessons and Best Practices Analyst Jacob Neal, participated in Exercise

Cyber Shield 2017 at Camp W.G. Williams, Utah during the period 23 April through 5 May 2017.

The exercise is an Army National Guard defensive cyberspace operations exercise with approximately 800 members of the Army National Guard, Air National Guard, Army Reserve and representatives of state and federal government agencies, industry partners and academia taking part. The purpose of the exercise is to provide a collective training event to evaluate cyber operations and set the conditions for team validation. Mr. Neal presented a Lessons Learned briefing and assisted many State National Guard teams with establish Joint Lessons Learned

Information System accounts, in order to track their own lessons learned.

Way Ahead: L&BP will continue to maintain contact with the various teams and assist as a liaison at Fort Gordon and the Cyber CoE. Further, he will coordinate with the Cyber CoE

Combined Arms Training Strategy personnel to share copies of the drills and tasks that the teams shared.

POC: Mr. Jacob Neal, (706) 284-8480, jacob.neal1.ctr@mail.mil, Rick San Miguel, (706) 791-

3409, ricardo.sanmiguel.civ@mail.mil…