A03-ATT0002 2.5 item a ISEC OPSEC Plan 2017.pdf

This is a Memorandum for Record documenting the Operations Security (OPSEC) Plan for the US Army Information Systems Engineering Command (USAISEC), dated August 2017.

The plan establishes procedural guidance and direction for USAISEC Directorates, Military, Civilian, and Contractor personnel on implementing OPSEC policy across all organizational activities at all locations. OPSEC is the analytical process that denies adversaries access to sensitive, unclassified national defense information through identification, control, and protection of indicators associated with planning and conducting U.S. Government operations. The plan applies to all USAISEC personnel, including those outside Fort Huachuca, Arizona headquarters and subordinate units under the Commander's jurisdiction. The OPSEC process involves five steps: identification of critical information, analysis of threats, analysis of vulnerabilities, assessment of risk, and application of OPSEC measures. Critical information includes sensitive mission areas containing For Official Use Only (FOUO) information and specific facts about USAISEC capabilities and activities vital to adversaries. The plan emphasizes protection of classified containers, restricted areas, clean desk policies, use of approved storage containers, and implementation of measures to protect classified and sensitive unclassified information during meetings, conferences, and planning sessions.

The memorandum delineates specific responsibilities for the USAISEC OPSEC Officer, USAISEC Directorates, Information Management Officer, and all USAISEC Soldiers, Civilians, and Contractors. Key responsibilities include annual OPSEC awareness training, proper review of materials before public release, reporting unauthorized solicitation attempts to security officers, compliance with Joint Ethics Regulation regarding social media use, and restrictions on using Government email addresses, logos, or computers for personal social media accounts. The document includes two enclosures detailing the USAISEC Critical Information List (CIL) identifying information categories foreign collectors would prioritize and the OPSEC Measures/Vulnerabilities addressing administrative, conference/travel, communications security, information security, personnel security, and physical security vulnerabilities with corresponding mitigation measures.