ASIS Intelligence Officer Psychometric Assessment cheat sheet

Intelligence cycle stages: direction, collection, processing, analysis and production, dissemination - each stage feeds the next and restarts on new requirements.

Collection disciplines (INTs): HUMINT, SIGINT, IMINT, GEOINT, OSINT, MASINT, and TECHINT; source reliability and information credibility are graded separately.

Admiralty/NATO source rating: letters A–F for source reliability, digits 1–6 for information credibility; A1 is fully reliable and confirmed, F6 cannot be judged.

Structured analytic techniques include ACH (Analysis of Competing Hypotheses), key assumptions check, devil's advocacy, red teaming, and what-if analysis.

Confirmation bias is the tendency to seek and weight evidence supporting an existing hypothesis; ACH counters it by scoring evidence against each hypothesis.

Indicator lists are observable events or conditions that distinguish one hypothesis from another and are monitored over time.

Link analysis maps relationships among entities (people, accounts, locations) using nodes and edges to reveal networks and key intermediaries.

Analysis of Competing Hypotheses selects the hypothesis with the least inconsistent evidence, not the one with the most supporting evidence.

Dissemination products: raw reporting, finished intelligence briefs, estimates, and warnings; each carries source, date, and confidence qualifiers.

Risk = Threat × Vulnerability × Consequence; reducing any factor reduces overall risk.

Threat is the likelihood and capability of an adversary or hazard to cause harm; vulnerability is a weakness that can be exploited.

Likelihood × Impact matrices (e.g., 5×5) place risks into tiers that drive treatment priority.

Risk treatment options: avoid, reduce (mitigate), transfer (share), and accept; residual risk remains after controls.

Threat assessment considers intent, capability, opportunity, and target attractiveness; all four shape the probability of attack.

CARVER matrix scores Criticality, Accessibility, Recoverability, Vulnerability, Effect, and Recognizability for target prioritization.

Defense in depth layers independent controls so failure of one layer does not defeat the whole protection system.

Qualitative ratings (low/medium/high) are faster but less precise than quantitative estimates using probabilities and monetary values.

Threat actors range from insiders and activists to organized crime and state-sponsored actors; each has distinct motives and tradecraft.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

Containment options include isolation (network/account), short-term mitigations, and evidence preservation before eradication.

Chain of custody documents who handled evidence, when, and how; breaks in the chain can render evidence inadmissible.

Order of volatility: collect CPU/cache and memory before disk, and disk before archival backups or logs.

Access control models: DAC (owner discretion), MAC (labels/clearances), and RBAC (role-based permissions).

Least privilege and separation of duties limit insider misuse and accidental damage.

Incident severity is typically graded by impact and scope (e.g., SEV1–SEV4) and drives escalation and notification timelines.

Business continuity (BCP) keeps critical functions running; disaster recovery (DRP) restores IT systems after disruption.

Logs, CCTV, badge records, and network telemetry are primary investigative sources; preserve originals and work from copies.

Intelligence requirements (EEIs/PIRs) state the decision the intelligence must support and are prioritized by command need.

Collection plans match each requirement to a collection discipline, asset, and reporting timeline.

SMART criteria for requirements: Specific, Measurable, Achievable, Relevant, Time-bound.

BLUF (bottom line up front) places the key judgment and its implications first, then supporting detail.

Estimative language conveys probability: likely, very likely, unlikely; calibrate terms to defined probability ranges.

Confidence levels (high/moderate/low) describe the strength of sourcing and analytic basis, separate from the probability estimate.

Reporting formats typically include summary, source description, key judgments, analysis, and recommendations.

Feedback loops (post-dissemination review) test whether intelligence met the customer's requirement and adjust future collection.

Necessity and proportionality: collection must be required for a legitimate purpose and no more intrusive than needed.

Minimization removes or masks irrelevant personal data from retained intelligence products.

Data protection principles: lawful basis, purpose limitation, data minimization, accuracy, storage limitation, and security.

Need-to-know and least privilege govern access; need-to-share policies support lawful information exchange.

Oversight mechanisms include internal review, independent inspectors, auditors, and judicial or legislative authorization.

Whistleblowing and reporting channels protect those who report misconduct; retaliation is itself a policy violation.

Ethical frameworks: utilitarian (greatest good), deontological (duty/rules), and virtue ethics (character) yield different conclusions.

Handling caveats (e.g., originator control, third-party rule) restrict further dissemination of shared intelligence.

Active listening: paraphrase, reflect feelings, ask open questions, and summarize to confirm understanding.

Open questions (what, how, why) elicit narrative; closed questions confirm specific facts.

Nonverbal cues (posture, eye contact, tone) carry meaning; incongruence between words and body language warrants attention.

Rapport building uses empathy, mirroring, and shared interests; it precedes effective information elicitation.

Feedback should be specific, behavioral, timely, and focused on observable actions rather than personality.

Assertiveness differs from aggression: it states needs and boundaries while respecting others.

Cross-cultural communication accounts for high-context vs. low-context styles, directness norms, and language barriers.

Conflict styles: avoiding, accommodating, competing, compromising, and collaborating - collaborating seeks mutual gain.

Briefing structure: purpose, key points (BLUF), supporting evidence, and clear ask or recommendation.

Heuristics are mental shortcuts that speed judgment but cause systematic biases (availability, anchoring, representativeness).

Anchoring bias over-weights the first piece of information; deliberate re-estimation counters it.

Groupthink symptoms: pressure to conform, self-censorship, illusion of unanimity; assign a devil's advocate to counter it.

Root cause analysis tools: 5 Whys, fishbone (Ishikawa) diagram, and fault tree analysis.

Occam's razor: prefer the simpler explanation when competing hypotheses fit the evidence equally.

Base rates (prior probabilities) should anchor estimates; ignoring them causes base-rate neglect.

Falsification: a hypothesis gains strength only when serious attempts to disprove it fail.

Problem-solving steps: define the problem, gather data, generate options, evaluate, decide, implement, and review.

Devil's advocacy and red teaming deliberately challenge consensus to surface overlooked risks and alternatives.