text: Chapter 4
  BEGIN RISK MANAGEMENT
  4-49. Commanders and staffs assess risk when they identify hazards, regardless of type. The IO officer
  assesses IO-associated risk throughout the operations process. The G-3 (S-3) incorporates the IO risk
  assessment into the command's overall risk assessment.
  4-50. IO-related hazards fall into three categories:
  * OPSEC vulnerabilities, including hazards associated with compromise of essential elements of
  friendly information.
  * Mission command vulnerabilities, including those associated with the loss of critical assets or
  identified during the vulnerability assessment.
  * Hazards associated with executing IO tasks.
  4-51. During mission analysis, the IO officer assesses primarily OPSEC- and mission command-related
  hazards, as well as hazards associated with IO-related specified and implied tasks identified up to this point
  in mission analysis. The list of task-associated hazards is refined during COA development, after articulating
  IRC tasks that support IO objectives. The IO element uses experience in previous operations as a means of
  identifying known or expected hazards, and IRC representatives often best articulate hazards associated with
  their tasks.
  4-52. As with all operations, IO entails risk. Resource constraints, combined with threat reactions and
  initiatives, reduce the degree and scope of advantage possible in the information environment. Risk
  assessment is one means commanders use to allocate resources. Staffs identify which hazards pose the
  greatest threat to mission accomplishment. They then determine the resources required to control them and
  estimate the benefits gained. This estimate of residual risk gives commanders a tool to help decide how to
  allocate resources and where to accept risk. (For detailed information on the integration of the risk
  management process, see ATP 5-19).
  DEVELOP COMMANDER’S CRITICAL INFORMATION REQUIREMENTS AND ESSENTIAL
  ELEMENTS OF FRIENDLY INFORMATION
  4-53. A commander's critical information requirement (CCIR) is an information requirement identified by
  the commander as being critical to facilitating timely decision making (JP 3-0). CCIRs include priority
  intelligence requirements (PIRs) and friendly forces information requirements (FFIRs). Staff sections,
  including the IO officer, recommend CCIRs to the G-3 (S-3). In a time-constrained environment, the staff
  may collectively compile this information. The G-3 (S-3) presents a consolidated list of CCIRs to the
  commander for approval. The commander determines the final CCIRs.
  4-54. Establishing CCIRs is one means commanders use to focus assessment efforts. CCIRs change
  throughout the operations process because the information that affects decision making changes as an
  operation progresses.
  4-55. During planning, staff sections establish IRs to obtain the information they need to develop the plan.
  Commanders produce CCIRs to support decisions they must make regarding the form the plan takes.
  4-56. During preparation, the focus of IRs and CCIRs shifts to decisions required to refine the plan. During
  execution, commanders establish CCIRs that identify the information they need to make execution and
  adjustment decisions.
  4-57. During mission analysis, the IO officer derives the information needed by the commander to determine
  how to employ IO during the upcoming operation. The IO officer recommends the IO IRs to be included in
  the CCIRs. This sub-step produces no IO-specific product unless the IO officer recommends one or more IO
  IRs as CCIRs. However, at this point, the IO officer should have assembled a list of IO IRs and submitted
  friendly-force-related IRs to the G-3 (S-3) and threat-related IRs to the G-2 (S-2).
  4-58. The following is an example of CCIRs for a stability operation in which an information operation is
  the decisive operation:
  * Who are the municipality's key players in ethnic violence?
  * What are the interests of the political parties?