Counterintelligence (CI) organizations use information about CPI and its projected use to determine the foreign collection threat to an acquisition program and subsequently the _________.

Counterintelligence (CI) organizations use information about CPI and its projected use to determine the foreign collection threat to an acquisition program and subsequently the _________.

• A. Security Classification Guide
• B. Program Protection Plan (PPP)
• C. Information Assurance Strategy
• D. System Security Plan

Answer: (B)

Focusing on how to guard Critical Program Information, counterintelligence uses what could be exploited about CPI and how it might be used to assess the foreign collection threat to the program. The next step is to translate that threat into concrete protection actions across the program, which is captured in the Program Protection Plan. This plan lays out what CPI needs to be protected, who is responsible, and which controls and processes—across people, processes, and technology—will be used to mitigate risks throughout the program’s life cycle. The other options don’t fit this role: a Security Classification Guide is about determining how information should be labeled and handled; an Information Assurance Strategy covers protecting information systems more broadly but not the program-wide CPI protection plan; a System Security Plan focuses on security controls for an individual system rather than the overarching program protection approach for CPI.

Focusing on how to guard Critical Program Information, counterintelligence uses what could be exploited about CPI and how it might be used to assess the foreign collection threat to the program. The next step is to translate that threat into concrete protection actions across the program, which is captured in the Program Protection Plan. This plan lays out what CPI needs to be protected, who is responsible, and which controls and processes—across people, processes, and technology—will be used to mitigate risks throughout the program’s life cycle. The other options don’t fit this role: a Security Classification Guide is about determining how information should be labeled and handled; an Information Assurance Strategy covers protecting information systems more broadly but not the program-wide CPI protection plan; a System Security Plan focuses on security controls for an individual system rather than the overarching program protection approach for CPI.