Information about friendly (U.S., allied, and/or coalition) activities, intentions, capabilities, or limitations an adversary seeks in order to gain a military, political, diplomatic, economic, or technological advantage. Simply put, any information that the “bad guy” wants and needs to do us harm or allows them to gain an advantage over us.

A person, or group of people, whose objective differs with the friendly objective.

A weakness that the adversary can exploit.

A measure of the potential degree to which protected information is subject to loss through adversary exploitation. Basically, this is the likelihood your information will be collected and acted on.

Anything that effectively negates or mitigates an adversary’s ability to exploit vulnerabilities.

Generally, ships cannot disclose specific information on friendly force troop movement or size tactical deployments, and dispositions that would jeopardize OPSEC or lives. This would include unit designations and names of operations.

Information on any ongoing or future operations to include details of specific combat missions, bomb damage assessments, force movements, employment schedules, and current location of underway units (i.e. latitude and longitude) is considered confidential and can only be released to authorized individuals.

Contact your local information assurance manager and describe the suspected phishing event to them. Do not forward any phishing emails.

Service members who are assigned as an OPSEC program manager should attend the two-day OPSEC course offered by the Naval OPSEC Support Team. This course outlines all requirements for an OPSEC program and covers what program managers need to do to be successful.

Critical information is different for everyone. Your critical information is that which you have determined is critical to the success of your mission at a given time and if it were to fall into the hands of an adversary, could be used to cause significant negative impacts to the accomplishment of your mission. Determining your critical information is vital to your success as an OPSEC practitioner.

There are two types of OPSEC assessments:

• Internal OPSEC assessments must be conducted annually by the OPSEC program manager

• External OPSEC assessments must be conducted once every three years by an outside entity (i.e. your ISIC or an OPSEC support element such as the NOST)