Offensive Cyber Operations and Mission Planning
Planning framework
The exam expects you to nest cyber mission planning inside the six-phase Joint Targeting Cycle: (1) end state and commander's objectives, (2) target development and prioritization, (3) capabilities analysis, (4) commander's decision and force assignment, (5) mission planning and force execution, (6) assessment. Cyber adds prerequisites conventional fires lack: access development, payload validation on a representative range, collateral-effects estimation for shared infrastructure, and a deconfliction line to the DCO and intelligence communities.
Vocabulary that gets tested
- Operational Preparation of the Environment (OPE) - non-intelligence activities conducted to plan and prepare for operations, such as mapping a network or prepositioning access. OPE precedes the operation and is not itself an attack.
- Cyber capability - software, hardware, or related equipment used to achieve effects in cyberspace.
- Effects - describe them by target-system function: temporary or persistent, reversible or irreversible, and with second-order consequences for shared hosting and cloud providers.
- Authorities - NSPM-13 delegates to the Secretary of Defense approval authority for certain OCO, still with legal review. It does not authorize covert action, which is Title 50 and requires a presidential finding.
Worked example
An operator wants to implant a beacon on a foreign utility's engineering workstation six months before a named operation to hold access for a later effect. Nothing is disrupted now. Reasoning: no effect is produced, so this is access development under OPE rather than an OCO mission - but it still requires authorization, and if the purpose is intelligence collection it is computer network exploitation under Title 50, not OCO. The trap is calling it an attack simply because the access is unauthorized.
Traps that cost marks
Confusing OPE with OCO; assuming 'effects' means destructive; skipping collateral-effects estimation when the target sits on shared infrastructure; and assuming a capability can be retasked in minutes when access took months to build.