Study guide
16.4 Information Access, Cybersecurity & Mobility
Air Force PFE Promotion Fitness Examination
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 PFE Exam Facts & Format 1.2 The WAPS Scoring System 1.3 The Tested AFH 1 Chapters & Study Strategy
2 Professionalism (AFH 1, Chapter 1)
2.1 The USAF Professional & the Profession of Arms 2.2 The Air Force Core Values & Their Virtues 2.3 Ethical Standards & the Airman's Creed
3 Military Organization & Command (AFH 1, Chapter 5)
3.1 The United States Armed Forces 3.2 The Military Departments & Services 3.3 Military Command Structure & Combatant Commands 3.4 The Air Force Total Force 3.5 Air Force Organizational Structure
4 Enlisted Force Development I (AFH 1, Chapter 7A–7D)
4.1 Leadership Levels 4.2 The Enlisted Force Structure & Tiers 4.3 Duty Titles & Special Positions 4.4 Force Development & the Competency Framework
5 Enlisted Force Development II (AFH 1, Chapter 7E–7H)
5.1 Training Responsibilities & Upgrade Training 5.2 Professional Military Education 5.3 The Community College of the Air Force 5.4 Continuing Education & Voluntary Programs
6 Assessments & Recognition (AFH 1, Chapter 8)
6.1 The Airman Comprehensive Assessment 6.2 Performance Evaluations & the EPB 6.3 Reenlistments, Retention & Continuation 6.4 Awards & Decorations
7 Enlisted Promotions (AFH 1, Chapter 9)
7.1 Promotion Systems & Programs 7.2 Promotion Cycles & Eligibility 7.3 Preparation & Individual Responsibilities 7.4 Promotion Testing & Test Control 7.5 Evaluation Boards & Central Selection
8 Personnel Programs & Benefits (AFH 1, Chapter 11)
8.1 Benefits & Services 8.2 Leave & Authorized Absences 8.3 Military Associations & Civilian Programs
9 Finance, Manpower & Resources (AFH 1, Chapter 12)
9.1 Individual Finances & Allowances 9.2 Official Travel Expenses & Allowances 9.3 Manpower Management 9.4 Resource Management & Stewardship 9.5 Environmental Commitment
10 Developing Organizations (AFH 1, Chapter 13)
10.1 Strategic Thinking & Results Focus 10.2 Resources & Organizational Structure 10.3 Change Management & Problem Solving
11 Developing Others (AFH 1, Chapter 14)
11.1 Teamwork & Team Dynamics 11.2 Develops People: Mentoring, Coaching & Feedback 11.3 Service Mindset & Fostering Effective Relationships 11.4 Leadership: Styles, Power & Influence
12 Developing Self I (AFH 1, Chapter 15A–15C)
12.1 Accountability & Self-Management 12.2 Military Communication 12.3 Preparing to Communicate
13 Developing Self II (AFH 1, Chapter 15D–15F)
13.1 Written Communication 13.2 Spoken Communication 13.3 Electronic Messaging
14 Developing Ideas (AFH 1, Chapter 16)
14.1 What We Know: Priorities & Innovation 14.2 Cognitive Processes & Critical Thinking 14.3 Informed Decision-Making 14.4 What We Don't Know: Uncertainty & Assumptions
15 Emergency Management (AFH 1, Chapter 17)
15.1 Air Force Emergency Management, Disasters & Hazards 15.2 Preparedness, MOPP & Individual Protection 15.3 Crisis Response & Recovery 15.4 Department of the Air Force Mishap Prevention 15.5 Risk Management
16 Security (AFH 1, Chapter 18)
16.1 Integrated Defense & Force Protection Conditions 16.2 Operations Security (OPSEC) 16.3 Information Protection & Classification 16.4 Information Access, Cybersecurity & Mobility 16.5 Antiterrorism
17 Standards of Conduct (AFH 1, Chapter 19)
17.1 A Way of Life: Oaths, Standards & Off-Duty Conduct 17.2 The Law of War 17.3 The Code of Conduct
18 Enforcing Military Standards (AFH 1, Chapter 20)
18.1 The Air Force Inspection System 18.2 Individual Accountability & Corrective Action 18.3 Appropriate Working Relationships & Fraternization 18.4 Addressing Misconduct & Prohibited Behavior
19 Fitness & Readiness (AFH 1, Chapter 22)
19.1 USAF Fitness & Comprehensive Airman Fitness 19.2 The Official Fitness Assessment 19.3 Nutrition & Performance 19.4 Substance Use, Abuse & Treatment Programs 19.5 Readiness State of Mind & Resilience
20 Military Customs & Courtesies (AFH 1, Chapter 24)
20.1 Honored Traditions: Saluting, Titles & Reporting 20.2 Respect for the Flag 20.3 Respect for Individuals 20.4 Ceremonies & Events 20.5 Drill & Formation 20.6 Preserving Our Heritage
21 SJT Format & Competencies
21.1 SJT Format & Mechanics 21.2 Airman Leadership Qualities (ALQs) 21.3 Foundational Competencies & Behaviors
22 SJT Reasoning, Scenarios & Traps
22.1 SJT Reasoning Strategies 22.2 Sample SJT Scenarios 22.3 SJT Traps & Best Practices
16.4 Information Access, Cybersecurity & Mobility
Key Takeaways Explain This Topic AI
The Freedom of Information Act imposes a mandatory time limit of 20 workdays to deny a request or release records, with a 10-workday extension permitted for specific unusual circumstances.
The Privacy Act prohibits disclosure of information from a system of records without the written consent of the subject individual, and System of Records Notices require a 30-day public comment period.
The five functions of the Air Force Cybersecurity Program are identify, protect, detect, respond, and recover.
All Air Force personnel must complete Information Assurance Awareness training prior to system access and annually thereafter.
Using public computing facilities such as hotel business centers to access web-based government services constitutes a compromise of login credentials and must be reported as a security incident.
Last updated: August 2026
The Privacy Act
"The Privacy Act of 1974 (as amended) establishes a code of fair information practices that govern the collection, maintenance, use, and dissemination of personal information about individuals that is maintained in a system of records by federal agencies." It provides individuals a means to seek access to and amend their records and sets forth agency record-keeping requirements .
Topic Rules
Disclosure Privacy Act rights are personal to the individual who is the subject of the record and cannot be asserted derivatively by others . The Act prohibits disclosure from a system of records without the written consent of the subject individual . The parent of any minor, or the legal guardian of an incompetent, may act on behalf of that individual
Collection Limited to what the law or executive orders authorize. System of Records Notices (SORNs) must be published in the federal register allowing the public a 30-day comment period. Collection must not conflict with the rights guaranteed by the First Amendment . A Privacy Act statement must be given when individuals are asked to provide personal information for collection in a system of records
System of records "A group of any records under the control of any agency from which information is retrieved by the individual's name, number, or unique identifier"
When disclosure is permitted: DoD personnel may disclose records to other DoD offices when there is "an official need to know," and to other federal agencies or individuals when the disclosure is a "routine use" published in the SORN or authorized by a Privacy Act exception . Information may also be released for a disclosed specified purpose with the subject's consent . The office of primary responsibility should keep an account of all information released.
Personally identifiable information must be safeguarded to ensure "an official need to know" access and to avoid actions that could result in harm, embarrassment, or unfairness to the individual. The Office of Management and Budget defines a PII breach as "a loss of control, compromise, unauthorized disclosure, unauthorized acquisition, unauthorized access, or any similar term referring to situations where persons other than authorized users and for an other than authorized purpose have access or potential access to personally identifiable information, whether physical or electronic."
The "retrieved by name, number, or unique identifier" definition is the discriminator — a collection of records is only a system of records if information is retrieved by an individual identifier.
The Freedom of Information Act
"The Freedom of Information Act provides access to federal agency records (or parts of these records) except those protected from release by specific exemptions." FOIA requests are written requests that cite or imply the Act .
- Timeline Value
- Mandatory time limit to deny the request or release the records 20 workdays
- Additional extension permitted for specific unusual circumstances 10 workdays
Denials require notification of appeal rights , and requesters can file an appeal or litigate. The reference is DoDM 5400.07-R / AFMAN 33-302 .
20 plus 10 workdays is the single most testable pair in Section 18D. Note both are workdays , not calendar days.
Cybersecurity
"Cybersecurity is defined as the prevention of damage to, protection of, and restoration of computers, electronic communications systems, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation."
The five properties — availability, integrity, authentication, confidentiality, and nonrepudiation — are worth memorizing as a set.
Cybersecurity disciplines named by AFH 1: Air Force Risk Management Framework, IT controls/countermeasures, communications security, TEMPEST (formerly emissions security), AF Assessment and Authorization (formerly Certification and Accreditation), and the Cybersecurity Workforce Improvement Program. The reference is AFI 17-130, Cybersecurity Program Management .
Training requirement: "All USAF personnel are required to complete Information Assurance Awareness training prior to system access and annually thereafter."
The Five Functions of the Air Force Cybersecurity Program
- Function What it means
- Identify Develop and maintain the organizational understanding required to manage cybersecurity risk
- Protect Implement controls to ensure the delivery of mission critical infrastructure services
- Detect Possess the ability to detect cybersecurity events when they occur
- Respond Possess the ability to take action regarding detected cybersecurity events
Recover Possess the ability to remain operationally resilient and to restore capabilities or services that were impaired
Identify, protect, detect, respond, recover. Note the overlap with the emergency management mission areas (prevention, protection, response, recovery, mitigation) and the integrated defense effects — three different five-part frameworks in three different chapters, which is exactly why the exam mixes them. The cybersecurity set is the one beginning with Identify and ending with Recover .
Computer and Information Systems Security
Computer security consists of "measures and controls that ensure confidentiality, integrity, and availability of information systems assets including hardware, software, firmware, and information being processed, stored, and communicated."
An information system is "a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information," and also includes specialized systems such as industrial/process controls, telephone switching and private branch systems, and environmental controls. That last clause surprises candidates — HVAC controls are an information system .
Protection is achieved by:
Controlling physical access to facilities and data
Ensuring user access is based upon a favorable background investigation, security clearance, and need to know (for classified)
Ensuring protection of unclassified, sensitive, and classified information through encryption per Federal Information Processing Standard Publication 140-2
A countermeasure is "any action, device, procedure, or technique that meets or opposes (counters) a threat, vulnerability, or attack by eliminating, preventing, or minimizing damage, or by discovering and reporting the event so corrective action can be taken."
The Three Steps of Malicious Logic Protection
Step Definition
Infection "The invasion of information system applications, processes, or services by a virus or malware code causing the information system to malfunction"
Detection "A signature or behavior-based antivirus system that signals when an anomaly caused by a virus or malware occurs"
Reaction "When notified of a virus or malware detection, react by immediately notifying your information system security officer and following local procedures"
Infection, detection, reaction — and the required action in the third step is to immediately notify the information system security officer , which is the answer to any scenario item about discovering malware.
Mobile Devices and Public Computing
Mobile computing devices are information systems — portable electronic devices, laptops, smartphones, and other handheld devices that can store data locally and access USAF managed networks. The rules:
All wireless systems — including peripheral devices, operating systems, applications, network connection methods, and services — must be approved prior to processing Department of Defense information
The information systems security officer maintains documented approval authority and inventory information on all approved devices
- All mobile computing devices not assigned or in use must be secured to prevent tampering or theft
- Users will sign a detailed user agreement outlining responsibilities and restrictions
Public computing facilities. "Do not use public computing facilities or services, such as hotel business centers, to process government-owned unclassified, sensitive, or classified information." These include any information technology resources not under your private or U.S. Governmental control .
The consequence clause is the tested part: "Use of e-mail applications, messaging software, or web applications to access web-based government services constitutes a compromise of login credentials and must be reported as a security incident." It is not merely discouraged — it is automatically a reportable security incident .
Communications Security
COMSEC refers to "measures and controls taken to deny unauthorized persons information derived from information systems of the U.S. Government related to national security and to ensure the authenticity of such information systems."
Component Definition
Cryptosecurity "A component of communications security resulting from the provision and proper use of technically sound cryptosystems"
Transmission security Results from "measures designed to protect transmissions from interception and exploitation by means other than cryptoanalysis." Examples: secured communications systems, registered mail, secure telephone and facsimile equipment, manual cryptosystems, call signs, or authentication
Physical security Results from "all physical measures necessary to safeguard communications security material from access by unauthorized persons" — control procedures and physical barriers . Common measures: verifying need to know and clearance, proper storage and handling, accurate accounting, authorized transport, and immediately reporting loss or possible compromise
The transmission security definition carries a key qualifier — "by means other than cryptoanalysis." Protecting against codebreaking is cryptosecurity ; protecting against interception is transmission security .
TEMPEST
"TEMPEST, formerly known as emissions security, is protection resulting from all measures taken to deny unauthorized persons information of value that may be derived from the interception and analysis of compromising emanations from cryptographic equipment, information systems, and telecommunications systems."
The objective: "to deny access to classified, and in some instances unclassified, information that contains compromising emanations within an inspectable space."
The inspectable space is "the area in which it would be difficult for an adversary with specialized equipment to attempt to intercept compromising emanations without being detected."
TEMPEST countermeasures named by AFH 1: classified and unclassified equipment separation, shielding, and grounding.
Three facts to hold: TEMPEST was formerly called emissions security , it addresses compromising emanations , and the protected zone is the inspectable space .