ANALYTICAL TRADECRAFT

A Practitioner’s Guide to the Analysis of Open-Source Intelligence

This page is an open reference on analytical tradecraft — the disciplined set of standards and methods that turn open-source information into a sound, defensible judgment. It covers the U.S. Intelligence Community analytic standards, the structured analytic techniques that meet them, and the source-evaluation discipline every open-source analyst needs.

The complete, formatted Analytical Tradecraft Study & Reference Guide — a printable field guide with the full treatment of every section below, plus a self-assessment workbook and a curated reference library — is available as a download for Patreon supporters of Fortune Favors the Prepared. The two foundational sections are reproduced in full on this page so you can judge the material for yourself.

What “tradecraft” means

Analytic tradecraft is the disciplined set of methods, standards, and habits that separate professional intelligence analysis from opinion, punditry, or a news summary. It is concerned less with what an analyst concludes than with how the conclusion was reached: whether the sourcing was sound, whether alternatives were genuinely considered, whether uncertainty was expressed honestly, and whether the reasoning can be audited by someone else.

Tradecraft exists because the human mind is predictably biased. It anchors on first impressions, sees patterns in noise, favors evidence that confirms what it already believes, and grows overconfident as it accumulates detail. Structured methods and explicit standards are countermeasures: they force the analyst to slow down, externalize reasoning, and test judgments before publishing them.

It is useful to separate two layers. Standards are the rules a product must satisfy — objectivity, proper sourcing, expression of uncertainty, consideration of alternatives, logical argumentation. Techniques are the structured methods an analyst uses to meet those standards. Standards tell you what good looks like; techniques are how you get there.

ICD 203 — the Analytic Standards

ICD 203 establishes the standards by which analytic products and analysts are evaluated. It is built around a small set of core standards and a set of tradecraft standards. The most operationally useful parts govern how analysts express likelihood and confidence — two ideas that are routinely confused and that ICD 203 insists be kept separate.

The core analytic standards

ICD 203 requires that analytic products be:

• Objective. Unbiased, evidence-driven, and free of distortion by advocacy, preference, or pressure. Judgments are not shaded to please a customer or fit a policy.
• Independent of political consideration. Analysis is not altered to support or oppose any political agenda or to advocate for a particular policy.
• Timely. Disseminated in time to be useful for decisions; an accurate product delivered too late has failed.
• Based on all available sources. Analysts use the full range of relevant information and acknowledge significant intelligence gaps.
• Implementing the tradecraft standards described below.

The nine tradecraft standards

These are the practical rules an analyst applies while constructing a product. They translate directly into checklist items:

1. Properly describes the quality and credibility of underlying sources.
2. Properly expresses and explains uncertainties.
3. Properly distinguishes between underlying intelligence and the analyst’s assumptions and judgments.
4. Incorporates analysis of alternatives.
5. Demonstrates customer relevance and addresses implications.
6. Uses clear and logical argumentation.
7. Explains change to, or consistency of, analytic judgments.
8. Makes accurate judgments and assessments.
9. Incorporates effective visual information where appropriate.

Likelihood vs. confidence — the distinction that matters most

ICD 203’s most practically important contribution is insisting that likelihood and confidence are two separate dimensions that must both be stated and never collapsed into each other.

• Likelihood is the probability that the event or development will occur. It answers: how probable is this?
• Confidence is the strength of the analyst’s basis for the judgment — driven by source quality, corroboration, and the soundness of reasoning. It answers: how solid is my footing in making this call?

These are independent. An analyst can be highly confident that something is unlikely, or have low confidence in a judgment that something is very likely. Collapsing them — saying only “probably” without indicating how well-supported the judgment is — hides exactly the information a decision-maker needs.

Standardized likelihood terms

ICD 203 provides a fixed ladder of expressions so that “likely” means the same thing across products and analysts. From least to most probable:

Two rules of use: do not blend a word from this ladder with a separate numeric probability that contradicts it, and do not invent intermediate terms. The fixed vocabulary is the point — it removes ambiguity.

Confidence levels

Confidence is expressed in three levels. The key requirement is that the level must be auditable: a reader should be able to look at the cited sourcing and reasoning and see why the analyst chose it.

When different elements of one judgment rest on different evidentiary footing, the analyst assigns split confidence — rating each element separately rather than averaging them into one misleading number. A finding might carry high confidence that an event occurred, moderate confidence about its scale, and low confidence about who caused it.

Failure modes ICD 203 is designed to prevent

• False precision — expressing a judgment with more exactness than the evidence supports.
• Hedging as cowardice — substituting vague phrasing for a committed assessment the evidence actually supports.
• Confidence-likelihood collapse — stating one dimension and silently omitting the other.
• Assumption laundering — presenting an analyst’s assumption as if it were reported intelligence.
• Buried change — quietly shifting a judgment from a prior product without acknowledging it.

What the rest of the guide covers

The two sections above are reproduced in full. The remaining sections, summarized here, are developed completely in the downloadable guide.

ICD 206 — sourcing requirements

The companion directive to ICD 203. Where ICD 203 says analysts must describe source quality, ICD 206 specifies how: consistent source referencing and source descriptors so a reader can understand and, where appropriate, retrace the evidentiary basis of a judgment. A tiered source registry is a direct, practical implementation of ICD 206 thinking.

Structured analytic techniques

Step-by-step methods that externalize and discipline reasoning, drawn from the CIA’s A Tradecraft Primer. The guide covers diagnostic techniques (Key Assumptions Check, Quality of Information Check, Indicators and Signposts of Change), contrarian techniques (Devil’s Advocacy, Team A / Team B, What-If and Red-Teaming), and imaginative techniques (Structured Brainstorming, Alternative Futures), with guidance on when to reach for each.

Analysis of Competing Hypotheses, in depth

The workhorse contrarian technique, treated step by step. ACH inverts intuitive analysis: instead of asking which evidence supports the preferred explanation, it asks which hypothesis is least contradicted by the evidence. The guide walks all eight steps, from generating a full hypothesis set to building and refining the evidence matrix to identifying indicators for future observation.

OSINT source tradecraft

The analysis-side discipline of judging open-source material well enough to reason from it responsibly. The guide covers the four-question Quality of Information Check (reliability, access, corroboration, deception or noise), a practical three-tier source model, and two standing source-handling rules: the framing caveat for state and partisan media, and aggregator stripping — tracing republished reporting back to its originating source so that one wire story under fifty mastheads is not mistaken for corroboration.

Supply-chain & critical-infrastructure risk frameworks

Reference coverage of NIST SP 800-161 (cybersecurity supply-chain risk management) and the CISA ICT supply-chain risk management resources, and how the analytic standards apply directly to supply-chain risk work.

Self-assessment & knowledge checks

A workbook of knowledge checks and applied prompts, each mapped to the standard or technique it tests, plus an honest self-rating checklist. Built to be used as study practice and as interview preparation.

The reference library — including military field manuals

The full guide closes with a curated reading list of unclassified, publicly available references. Alongside the IC directives and the structured-technique texts, it includes U.S. military intelligence doctrine — among the clearest and most accessible public treatments of analysis tradecraft, and a strong demonstration of how the same standards are applied in an operational doctrine setting.

The library also lists the core IC directives (ICD 203 and ICD 206), the foundational structured-technique texts (the CIA Tradecraft Primer; Heuer’s Psychology of Intelligence Analysis; Heuer and Pherson’s Structured Analytic Techniques for Intelligence Analysis), and the supply-chain risk frameworks.