text: Chapter 4
  COAs results from first identifying HVTs and HPTs. Threat COAs include templates and event matrices that
  identify potential objectives, named areas of interest and target areas of interest. A named area of interest is the
  geospatial area or systems node or link against which information that will satisfy a specific information
  requirement can be collected (JP 2-01.3). A target area of interest is the geographical area where high-value
  targets can be acquired and engaged by friendly forces (JP 2-01.3).
  4-38. The CEMA section conducts terrain analysis to examine aspects of terrain in cyberspace and the EMS
  for determining obstacles such as firewalls, port blocks, threat sensors, and jamming capabilities that require
  immediate mitigation for continued operation. The CEMA section also identifies the various avenues of
  approach to employ cyberspace attack and EA on enemy cyberspace and EMS capabilities. Through terrain
  analysis, the CEMA identifies potential weaknesses in friendly forces’ posture in cyberspace and the EMS that
  require additional cover and concealment through such techniques as electromagnetic hardening actions,
  password protection, emission control, or by incorporating Internet Protocol (IP) hiding techniques.
  4-39. During terrain analysis, it is important to identify key locations in cyberspace and the EMS that can
  become access points. These access points provide avenues of approach or can provide observation and fields
  of fire where network traffic can be monitored, intercepted, or recorded through SIGINT, cyberspace
  exploitation, or ES. By identifying cyberspace and EW-related obstacles, avenues of approach, cover and
  concealment, and observation and fields of fire, the CEMA section can determine locations in those aspects of
  terrain to consider as key terrains. Key terrains include those major access points for observing incoming threats
  and avenues for launching cyberspace attack and EA. Terrain in cyberspace and the EMS connected to critical
  assets on the DODIN are considered as key terrains.
  Note. For more information on the IPB process, see ATP 2-01.3.
  INFORMATION COLLECTION
  4-40. Information collection is an activity that synchronizes and integrates the planning and employment of
  sensors and assets as well as the processing, exploitation, and dissemination systems in direct support of current
  and future operations (FM 3-55). These sensors and assets may include cyberspace operations and EW assets
  conducting cyberspace exploitation operations, electromagnetic probing, and electromagnetic reconnaissance
  for information collection.
  4-41. Information collection is the acquisition of information and the provision of this information to
  processing elements. Information collection integrates the intelligence and operations staff functions with a
  focus on answering the CCIRs, and IRs that assists the commander and staff in shaping the OE and conducting
  operations. The commander drives information collection coordinated by the staff and led by the G-2 or S-2.
  The following are the steps of information collection:
  * Plan requirements and assess collection.
  * Task and direct collection.
  * Execute collection.
  4-42. Information collection enables the commander to understand and visualize the operation. Information
  collection identifies gaps in information that require aligning intelligence assets with cyberspace exploitation,
  electromagnetic reconnaissance, and electromagnetic probing to collect data on those gaps. The decide and
  detect steps of targeting also rely heavily on information collection. Enemy cyberspace capabilities identified
  through information collection assist the CEMA working group in identifying potential targets and key terrain
  in cyberspace.
  PLAN REQUIREMENTS AND ASSESS COLLECTION
  4-43. The G-2 or S-2 collaborates with the other staff to receive and validate IRs for collection. The CEMA
  section provides the G-2 or S-2 with cyberspace and EMS-related IRs requesting information on friendly,
  enemy, and neutral actors operating in the AO. The CEWO identifies all cyberspace and EMS-related IRs to
  present to the commander as potential CCIRs. The G-2 or S-2 prepares the requirements planning tools and
  recommend cyberspace and EW assets for information collection to the G-3 or S-3.