How is information security and OPSEC managed in a squadron?

• A. By controlling access to information, proper handling of sensitive material, and following OPSEC procedures
• B. By posting all information publicly
• C. By outsourcing to third-party cloud providers exclusively
• D. Only training officers

Answer: (D)

Managing information security and OPSEC in a squadron hinges on three interrelated practices: controlling who can access information, ensuring sensitive material is handled properly, and following OPSEC procedures to identify and protect critical information.

Controlling access means applying the principle of least privilege—only giving personnel the information they need to do their jobs. This includes both digital access (secure networks, authenticated logins, and encryption) and physical access (restricted areas, need-to-know clearance, controlled dissemination of materials). When access is tightly managed, the chance of accidental or intentional disclosure is greatly reduced.

Handling sensitive material focuses on how information is stored, transmitted, and disposed of. Proper labeling, classification, and secure storage are essential, as is using approved methods for transmitting sensitive data (encrypted channels, marked documents, approved media). Destruction and disposal must be verifiable so information cannot be retrieved after it’s no longer needed.

OPSEC procedures provide a structured way to protect operations by identifying what information is critical, evaluating potential threats and vulnerabilities, and applying targeted countermeasures. This includes training everyone in recognizing OPSEC risks, conducting regular drills and reviews, and updating protective measures as situations change. In practice, OPSEC is not just about one person or one process—it’s a recurring cycle that involves the entire squadron.

Public posting of information would expose operations to unnecessary risk. Relying exclusively on third-party cloud providers ignores the need for internal controls and ongoing oversight. Limiting protection to officers only covers a fraction of what’s needed; all personnel play a part in safeguarding information. The strongest approach integrates access control, proper handling, and OPSEC procedures across the entire squadron.