Lab Guide — Facilitated OPSEC Self-Assessment

Facilitated exercise · 45 minutes · Fictional executive persona

What this lab is

A guided run of the five-step OPSEC process against a fictional executive persona, "Principal M" — a senior leader at a high-sensitivity organisation. Working in small groups, you will identify critical information, list the indicators an adversary could collect, and choose countermeasures. Nothing here is real; the goal is to internalise the loop so you can run it on yourself in the homework.

The persona: Principal M

Brief

Principal M chairs a body that makes contested funding decisions. M keeps a public bio, travels monthly to partner sites, has an active personal social presence, employs two aides who post team photos, and uses a mix of personal and corporate devices. M's calendar is shared widely inside the organisation.

Part A — Steps 1–2 (15 min)

Critical information & threat

List the 3–5 things an adversary must not learn about M (decisions, timing, locations, relationships).
Name two plausible adversaries and, for each, what they can realistically collect.

Part B — Steps 3–4 (15 min)

Vulnerabilities & risk

For each piece of critical information, list where an indicator currently leaks (calendar, travel, aide posts, suppliers, devices).
Rank the leaks by likelihood × impact. Circle the top three.

Part C — Step 5 (15 min)

Countermeasures

For each of your top-three leaks, choose one countermeasure and label it deny, disrupt, or degrade. Note who must change behaviour — M, an aide, or a supplier.

✓ Self-check: your group can state Principal M's critical information, the two or three highest-risk indicators, and a specific, owned countermeasure for each — and can explain how those indicators aggregated into a targeting picture.