CTAS study plan

Draft a written requirements document that names each intelligence consumer, the decision each consumer owns, and the priority intelligence requirements (PIRs) that support those decisions

Map every PIR to at least one specific intelligence question and state the acceptable latency and confidence threshold for each

Classify a list of 15 candidate sources by collection discipline (OSINT, HUMINT, SIGINT-derived reporting, commercial feeds, internal telemetry) and by reliability and credibility using an Admiralty-style source grading scheme

Build a source inventory register in a spreadsheet with fields for provenance, refresh cadence, access cost, licensing constraints, and known bias

Decompose each PIR into named observable indicators that collection can actually detect

Compare at least four collection architectures (direct API pull, commercial feed subscription, sensor telemetry pipeline, manual analyst collection) on latency, coverage, cost, and legal exposure

Write collection tasking sheets that assign each indicator to a named source, an owner, a cadence, and an escalation path for source failure

Implement source reliability scoring that tracks observed accuracy against later-confirmed events over a rolling window

Identify and document three single points of failure in a hypothetical collection stack and propose a mitigation for each

Draft a source onboarding and offboarding checklist covering legal review, credential handling, and data retention

Normalize heterogeneous raw data (timestamps, IP and domain formats, hashing, encoding) into a single schema and document every transformation applied

Apply structured analytic techniques including key assumptions check, analysis of competing hypotheses, and indicators or signposts to one live intelligence question

Write link analysis that connects infrastructure, malware family, and campaign artifacts into a defensible cluster with stated confidence levels

Separate observed fact from inference from judgment in every written analytic paragraph you produce

Produce intelligence requirements-driven reporting that answers the PIR rather than describing the data

Map a documented intrusion to each phase of the attack lifecycle and cite the specific evidence supporting each phase assignment

Extract and document adversary tactics, techniques, and procedures at a level of granularity that supports detection engineering, not just narrative description

Write detection hypotheses derived from observed TTPs and specify the telemetry each hypothesis requires

Assess analytic confidence using a defined scale and justify downgrades where evidence is single-sourced or circumstantial

Peer-review a colleague's or your own prior product against a checklist for logical fallacies and unsupported leaps

Build an attack lifecycle coverage matrix showing which lifecycle phases current detection and collection actually cover and where gaps remain

Model two plausible adversary courses of action against a defined asset set and state the indicators that would discriminate between them

Score a set of threats on likelihood and impact using an explicit, documented rubric rather than intuition

Translate threat scores into a prioritized risk register with named owners and treatment options (mitigate, transfer, accept, avoid)

Reassess two prior judgments in light of new reporting and document what changed and why

Write a strategic threat assessment that projects adversary intent and capability over a 6-12 month horizon with explicit assumptions and indicators to watch

Tailor the same findings into three dissemination formats for three audiences: executive decision-maker, technical defender, and peer analyst

Design a dissemination workflow that specifies classification marking, distribution list, timeliness targets, and feedback capture

Define decision-support metrics that measure whether products changed or informed a decision, not just whether they were read

Draft a warning notice template for time-sensitive threats with a clear recommended action

Map the legal and policy constraints that apply to each collection source in your register, including privacy, data handling, and sharing restrictions

Classify a set of realistic analytic scenarios against an ethical decision framework and document the reasoning for each

Write handling rules for sensitive data that specify access control, retention period, and destruction procedure

Identify where dissemination could expose sources or methods and propose redaction or tearline controls

Draft an escalation procedure for a request that is legally permissible but ethically questionable

Define a program metrics framework with leading and lagging indicators covering collection coverage, analytic timeliness, product accuracy, and consumer satisfaction

Conduct a self-assessment against all eight domains and score current proficiency with evidence for each rating

Build a 90-day continuous improvement plan that targets the three weakest domains with specific actions and review dates

Run one after-action review on a prior product in this plan and record concrete process changes

Assemble a portfolio of all deliverables and index them against the exam domain weights