SEC-02-01
What OPSEC Actually Is
And what it is not
Downloads & Print Edition
Student Companion Guide (PDF)
Full reference guide: lesson summaries, key terms, and OPSEC cycle worksheets.
Download →
Order the Printed Loose-Leaf Workbook
Printed and punched for a three-ring binder. Fill-in worksheets for every step of your OPSEC cycle.
Order →
Operations Security is not a checklist, a password manager, or a collection of individual habits. It is an analytical process — a method for figuring out which information about you could hurt you if seen by the wrong person, and then doing something disciplined about it. Until you understand what the process is, you will confuse activity for protection.
The Discipline, Defined
What the Doctrine Says
The official definition from JP 3-13.3 is precise and worth sitting with: OPSEC is a process of identifying critical information and subsequently analyzing friendly actions to determine what indicators an adversary could collect, then selecting measures to eliminate or reduce those vulnerabilities to an acceptable level.
Three words in that definition do the heavy lifting. First, process — not a product, not a posture, not a vibe. A process is something you run deliberately and repeatedly, with inputs and outputs. Second, indicators — the observable traces that your activities leave behind, separate from the underlying information itself. Third, acceptable level — a risk management phrase, not a risk elimination phrase. OPSEC does not promise invisibility. It promises a rational, prioritized reduction in exposure.
This definition was formalized in 1988 under NSDD-298 following lessons drawn from the Vietnam-era PURPLE DRAGON study, which found that the North Vietnamese were often not breaking American codes — they were reading American operational patterns. The enemy did not need secrets. They needed patterns, and the Americans provided plenty of them. The entire discipline of OPSEC grew from that finding.
What People Confuse It With
Clearing the Misconceptions
The most common mistake is treating OPSEC as synonymous with privacy practices — using a VPN, covering your camera, encrypting your messages. Those tools may support OPSEC, but they are countermeasures, not the process. You can implement every privacy tool on the market and still have terrible OPSEC, because you never identified your critical information, never assessed who your actual adversary is, and never mapped which of your behaviors are creating indicators that adversary can use.
The second common mistake is treating OPSEC as secrecy maximalism — the idea that less information shared is always better. That is not what the process teaches. The goal is to protect the information that matters, not to protect all information from all people at all times. Undisciplined blanket secrecy tends to collapse under its own friction, and it does not survive contact with the real world. A targeted, reasoned approach survives.
The third mistake is treating OPSEC as a one-time event — a policy you write, a training you attend, a list you check. The doctrine is explicit that OPSEC is a continuous cycle. Threats change. Adversaries get smarter. Your operations evolve. A good OPSEC posture from three years ago may be a poor one today.
The militia that secured its communications and lost anyway
A group spent considerable effort encrypting all their digital communications and keeping their meeting locations off social media. What they did not do was run an OPSEC process. They never identified their critical information, so they did not notice that their monthly supply orders — placed in cash at the same vendors, at the same intervals — were creating a clear pattern. A single curious party in the supply chain could build an accurate picture of their group size, operational tempo, and equipment priorities without ever touching their encrypted messages. The encryption was a countermeasure applied without analysis. The process would have caught the supply pattern first.
Why the Process Comes Before the Tools
The five-step OPSEC process — which this course covers in full — is the diagnostic before the prescription. You cannot know which countermeasures to apply until you know what your critical information is, who wants it, and which of your behaviors are leaking it. Applying tools before that analysis is the equivalent of taking medication before the diagnosis: it might help by accident, but it is not medicine.
This lesson grounds everything that follows. The remaining six lessons will walk through each element of the process and help you apply it to your own situation. By the end, you will be able to produce a functional personal OPSEC assessment — the foundation that SEC-06 Applied OPSEC will build on directly.
Write down three things you currently do in the name of “security” or “privacy.” For each one, ask: did I decide to do this because I ran an analysis, or because it felt like a good idea? If the answer is the latter for all three, this course will change how you think about protection.
According to JP 3-13.3, OPSEC is best described as:
I understand that OPSEC is a process, not a product or a collection of tools.
I can distinguish between OPSEC countermeasures and the OPSEC process itself.
I understand that OPSEC aims for acceptable risk reduction, not total concealment.
I know that OPSEC originated from analysis of observable behavioral patterns, not broken codes.