text: Planning
  4-96. The IO officer examines each COA and its scheme of IO to determine if they contain hazards not
  identified during mission analysis. The IO officer then develops controls to manage these hazards, determines
  residual risk, and prepares to test the controls during COA analysis. The IO officer coordinates controls with
  other staff sections as necessary. Controls that require IRC tasks to implement are added to the IO COA
  worksheet for the COA.
  4-97. The IO officer considers two types of hazards associated with the scheme of IO: those associated with
  the scheme of IO itself and its supporting IRC tasks; and those from other aspects of the concept of operations
  that may affect execution of IO. The IO officer identifies as many of these hazards as possible so the
  commander can consider them in decisions.
  4-98. Some hazards result from the need to focus IO efforts. These hazards require commanders to take
  prudent risks. Some examples include:
  * As part of a military deception operation, the commander limits camouflage, concealment, and
  deception measures applied to elements they want the adversary to detect. The commander accepts
  the risk of the threat targeting these elements.
  * The commander concentrates cybersecurity efforts on a few critical mission command nodes,
  accepting the risk that other nodes may be degraded.
  * The commander elects to destroy an adversary communications node that is also a valuable
  intelligence source. The commander accepts the risk of operating without that intelligence.
  4-99. Hazards also result from unintended actions by the threat and other forces/groups in response to
  friendly IO. In addition, unintended consequences of other tactical activities can affect IO. Examples include:
  * An electronic attack may disrupt friendly as well as threat communications.
  * In a stability operation, efforts to influence a mayor to support U.S. forces instead of simply not
  opposing them may boost the popularity of an anti-U.S. rival, risking loss of long-term local
  political support.
  4-100. Thorough planning can reduce, but will never eliminate, unintended consequences. The IO officer
  identifies possible unintended consequences that cause effects within the information environment and
  focuses on those most likely to affect mission accomplishment.
  4-101. The IO officer considers the effects of IO-related hazards on the local populace and infrastructure as
  well as on friendly forces. The IO officer assesses these hazards, develops controls, determines residual risks,
  and advises the commander on risk mitigation measures. These unintended consequences could be caused by
  an IRC or by other activity that causes effects in the IE.
  4-102. The commander alone accepts or rejects risk. The IO officer advises the commander concerning risk
  associated with IO-related hazards and recommends controls to mitigate this risk. The commander decides
  what risk to accept. An example of using IO for accident risk mitigation is the synchronized use of civil
  military operations and MISO, in coordination with public affairs, to warn the local populace of the accident
  hazards associated with military operations. When risks are attributable to IRC tasks, the IO officer assigns
  risk mitigation measures to the responsible unit and places them in the IO appendix’s coordinating
  instructions.
  4-103. The IO officer produces a list of IO-related hazards and assessments of the associated risks. This list
  becomes the IO input to the G-3 (S-3) risk assessment matrix. (For detailed information on assessing risk
  levels, see ATP 5-19.)
  Measures of Performance and Effectiveness
  4-104. Measures of performance and measures of effectiveness drive information requirements necessary
  to measure the degree to which operations accomplish the unit's mission. As COA development continues,
  the IO officer considers how to assess IO effectiveness, by determining:
  * IRC tasks that require assessment.
  * Measures of performance for IRC tasks and measures of effectiveness for IO objectives, as well
  as baselines to measure the degree of change, and associated IO-related targets.
  * The information needed to make the assessment.