I can tell you about the resources, books, and guides that I'm familiar with - they are specific to the United States public sector. Not all of it is specific t

I can tell you about the resources, books, and guides that I'm familiar with - they are specific to the United States public sector. Not all of it is specific to Operational Security, but one could say that it is all related. Many federal departments and agencies must implement security programs based on guidelines and recommendations from Department of Commerce's National Institute of Standards and Technology, who created the Special Publication 800 Series for Computer Security, also the Special Publication 1800 Series for Cybersecurity Practice Guidelines. (http://csrc.nist.gov/publications/PubsSPs.html http://csrc.nist.gov/publications/PubsSPs.html) These departments and agencies are also required to report their cyber security incidents to the United States Computer Emergency Readiness Team (US-CERT) so that security events, incidents, and responses may be coordinated across departments and agencies. (https://www.us-cert.gov/government-users/compliance-and-reporting https://www.us-cert.gov/government-users/compliance-and-repo...) Today's federal departments and agencies are connected to trusted internet connections (TICs) that are all held up to high standards of incident reporting and security management. (https://www.dhs.gov/trusted-internet-connections https://www.dhs.gov/trusted-internet-connections) Same goes for the providers of their PKI infrastructure (https://www.idmanagement.gov/IDM/servlet/fileField?entityId=ka0t0000000TNYYAA4&field=File__Body__s https://www.idmanagement.gov/IDM/servlet/fileField?entityId=... ). Other key pieces of computing and communications infrastructure are also held to standards, such as the ones published by Federal Network Resilience group, but are not made available publicly. The CAESARS Framework (http://csrc.nist.gov/publications/drafts/nistir-7756/Draft-NISTIR-7756_second-public-draft.pdf http://csrc.nist.gov/publications/drafts/nistir-7756/Draft-N...) is the best example of a highly-integrated continuous monitoring program which integrates security operations with executive-level risk management. Lots of money has been invested in creating great frameworks, but many agencies and departments struggle to implement these in practice.