Attachment 0001 DD Form 254.pdf

CLASSIFICATION (When filled in): Official

21-R-0133

21-R-0133 PREVIOUS EDITION IS OBSOLETE. Page 1 of 4DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 1 of 4DD FORM 254, MAY 2019

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

20220531

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

W56HZV-21-R-0133

DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE

TBD

b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

Hardware Production resulting from STS Upgrades, Engineering Change Proposals (ECPs), Maintenance Work Orders (MWOs), and Pre- Fielding failures for PEO GCS supported platforms. Can also include Training equipment & Test equipment, and will also satisfy requirements for hardware where there is no demand in Army supply system which PEO GCS needs to support.

21-R-0133

21-R-0133 PREVIOUS EDITION IS OBSOLETE. Page 2 of 4DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 2 of 4DD FORM 254, MAY 2019

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

(1) Security Classification Guidance

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

Follow and Implement:

- Threat Awareness and Report Requirements (TARP)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

PD MBTS Security Manager See Block 17 for contact information

Public Release Authority:

PCO

13. SECURITY GUIDANCE Add Signature Remove last Signature Delete All Signatures

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

The following attachments are made part of this DD Form 254:

Attachment A – Guidelines for Controlled Unclassified Information (Item 10.j) Attachment B – PEO GCS OPSEC Plan Unclassified information shall be protected IAW the Security Classification Guide, OPSEC Plan, and Attachment A.

See added page(s) for continuation of Block 13 Item 10.e.(1) – SCI: Authorization and requirements for SCI access will be specified for each individual procurement.

Item 10.f –SAP: Authorization and requirements for SAP access will be specified for each individual procurement. Access to SAP information requires employees undergo additional personnel security screening and meet the SAP access standards. Discussion, storage, or processing of SAP information associated with this contract shall be conducted in facilities specifically accredited by the Army Program Security Officer. SAP information/material will be accessed, processed and/or stored in accordance with the additional security Guidelines for Special Access Information. Written concurrence from the Program Security Officer is required prior to subcontracting.

NOTE: if you are adding SAP to any contract, please bring this to the attention of the PEO GCS Activity Security Officer BEFORE issuing the DD254 as a SAP PSO is required to sign the DD254. Additional language will need to be added to the DD254 (such as

21-R-0133

21-R-0133 PREVIOUS EDITION IS OBSOLETE. Page 3 of 4DD FORM 254, MAY 2019 PREVIOUS EDITION IS OBSOLETE. Page 3 of 4DD FORM 254, MAY 2019 restrictions in Block 12, adding information in Block 14, as well as a SAP Attachment from the appropriate program office to name a few changes.

Item 10.j –CUI: CUI shall be safeguarded and marked in accordance with Guidelines for CUI (Attachment A).

Item 10.k.(1) – SECURITY CLASSIFICATION GUIDANCE: Applicable Security Classification Guide (SCG) will be provided with each separate procurement.

Item 11.c – RECEIVE, STORE, AND GENERATE: Authorization and requirements for classified access will be specified for each individual procurement. If authorized, the contractor requires access to classified source data up to and including Secret in support of the work effort. Any extracts or use of such data requires the contractor to apply derivative classifications and markings consistent with the source documents. All classified information received is the property of the U.S. Government. At the termination or expiration of this contract, the U.S. Government will be contacted for the proper disposition instructions. Contractor will abide by the security classification guides specified in the procurement contract.

Item 11.f – HAVE ACCESS OUTSIDE U.S.: Performance may occur at the Army/U.S. activity located in the procurement contract.

Item 11.i – TEMPEST: Refer to scope of work that addresses the submission of this requirement. This requirement shall be flowed down to all U.S. subcontractors that use Information Systems to process classified material.

Item 11.j – OPSEC: Refer to scope of work and the CDRL that address the submission of this requirement. These requirements, OPSEC Plan and training, shall be flowed down to all U.S. subcontractors with access to CUI and/or classified material.

Item 11.l. – CUI: CUI shall be safeguarded and marked in accordance with Guidelines for CUI (Attachment A).

Item 11.m.(1) – TARP: ICW NISPOM 1-301, the contractor shall report threat-related incidents, behavioral indicators, and other matters of counterintelligence (CI) interest specified in AR 381-12, Chapter 3, through the facility security officer to the government security officer, the nearest military CI office, the Federal Bureau of Investigation, and the Defense Security Service. Annually, train personnel who handle classified information IAW AR 381-12, Chapter 2. This requirement shall be flowed down to all U.S. subcontractors that have access to classified information/material. Contact the individual in Block 17 to obtain local CI office information.

Notification of loss or compromise of collateral classified information shall be provided to the individuals identified in Blocks 16 and 17 within 72 hours of the incident, in addition to the reporting requirements outlined in the NISPOM.

List of Attachments [2] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

Add Attachment View Selected Attachment Remove Selected Attachment

NAME & TITLE OF REVIEWING OFFICIAL

Christopher Havrilla

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

See Block 13 for additional requirements.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

The Defense Security Service has cognizance over this contract. The Government Security Manager reserves the right to inspect compliance with the DD254, the PPP and Guidelines for CUI.

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

21-R-0133

21-R-0133 PREVIOUS EDITION IS OBSOLETE. Page 4 of 4DD FORM 254, MAY 2019

a. GCA NAME

PD MBTS

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

W56HZV

c. ADDRESS (Include ZIP Code) 6501 East Eleven Mile Road SFAE-GCS-M / mail stop 506 Detroit Arsenal, MI 48397-5000

d. POC NAME

Christopher Havrilla

e. POC TELEPHONE (Include Area Code)

+1 (586) 282-7248

f. EMAIL ADDRESS (See Instructions) christopher.r.havrilla.civ@mail.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

Rick Moore

b. TITLE

PEO GCS Security Manager

c. ADDRESS (Include ZIP Code) 6501 East Eleven Mile Road SFAE-GCS-M / mail stop 506 Warren, MI 48397-5000

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

W56HZV

e. CAGE CODE OF THE PRIME CONTRACTOR

(See Instructions.)

f. TELEPHONE (Include Area Code)

+1 (586) 282-2841

g. EMAIL ADDRESS (See Instructions) richard.w.moore6.civ@mail.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

ASPD and 902d

(Enter contract name and number here)

ATTACHMENT A

ADDITIONAL GUIDELINES FOR CONTROLLED UNCLASSIFIED INFORMATION

General: There are types of information that are not classified but that require application of access and distribution controls and protective measures for a variety of reasons. This information is known as “controlled unclassified information (CUI).” The types of information considered CUI are U.S. Government technical information and information listed at the DOD CUI registry (https://www.dodcui.mil/Home/DoD-CUI-Registry/). When handling CUI material, all personnel are to comply with these requirements and follow their company policy and/or applicable

Non-Disclosure Agreement (NDA) concerning the protection of proprietary information in situations not clearly stated herein.

Technical Information Description: Any recorded information related to experimental, developmental, or engineering works that can be used to define an engineering or manufacturing process, or can be used to design, procure, produce, support, maintain, operate, repair, or overhaul program material. The data may be graphic or pictorial delineations in media (e.g., computer software, drawings, or photographs), text in specifications, related performance or design documents, or computer printouts. Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, catalog-item identifications, and related information, and computer software documentation.

CUI Information Description: This is unclassified Information that requires safeguarding or dissemination controls pursuant to and consistent with applicable law, regulations, and government-wide policies (LRGWP) but is not classified under EO 13526, (Classified National Security Information).

CUI Markings All documents containing CUI will carry the CUI markings in accordance with DoDI 5200.48. Discontinue all use of legacy or other markings not permitted or included in either the DOD CUI Registry or DoDI 5200.48. Marking of Technical Information will include the Distribution Statement provided in the Security Classification Guide. If the contents of the technical document require more than one Distribution Statement, apply the most restrictive statement. This does not preclude additional mandated markings as may be required by the contract.

Protection of CUI Information

Supplier / Developer Capture or Creating CUI Data and Storage/Handling: CUI may be captured, created or evolved as part of aggregation of data in any form. This is a natural by-product during the development or testing efforts at USG facilities or the Supplier’s managed and controlled facilities. All CUI requirements apply to any and all aspects of the data and the supplier shall follow all described processes and procedures. If a cooperative or distributed team of primary and secondary suppliers are engaged, all are bound by the same requirements. Reference NIST SP 800-161 for Supply Chain tiered level requirements. All Supplier networks and the systems attached (Network accessible storage, external drives, and all related environments) must adhere to the protection requirements i.e. Networks accessible to the Public Internet or Supplier enterprise networks must meet all CUI storage and handling requirements.

Access: CUI may be released only to an individual who has a valid need for such access in connection with the accomplishment of a lawful and authorized Government purpose under this contract. Further dissemination of such information will be at the discretion of the Government Security Manager. Personnel no longer requiring access to CUI must dispose (see “Disposal” below) or surrender any in their possession and terminate future access to it.

Storing/Handling: During working hours, take reasonable steps to minimize risk of access to CUI by unauthorized personnel. After working hours, when not in physical possession of the owner, all CUI (whether hardcopy or optical media (e.g., DVDs, CDs) that contain CUI) must be afforded a reasonable degree of physical protection to prevent theft of program information (e.g., store CUI information in locked desks or file cabinets, locked rooms, cable lock laptops, storing in a trunk, storing out of site or similar means). Do not display CUI in public places (e.g., airports, airplanes, restaurants). Electronic storing and processing of CUI shall be in accordance with DFARS 252.204-7012 Safeguarding Controlled Defense Information and Cyber Incident Reporting. Do not process CUI on public computers (e.g., those available for use by the general public in kiosks, hotel business centers), public wireless networks or computers that do not have access control. Personally owned computers and personally owned devices are not authorized to process CUI. Portable electronic devices (e.g., smartphones, laptop computers, tablets), non- portable computers, and removable media (e.g., external hard drives, flash drives, USB drives; not including optical media) must be physically and electronically protected as described in this instruction, DFARS 252.204-7012 and DoDI 8582.01. Information systems processing CUI must meet NIST Special Publication (SP) 800-171 security requirements. A basic self-assessment will be completed by the collaborator and documented in the Supplier Performance Risk System (SPRS) at https://www.sprs.csd.disa.mil// and concurrence provided by PEO GCS weapon system ISSM prior to processing CUI on covered systems.

Dissemination: CUI printed documents and material may be transmitted through mail channels, commercial carrier or hand-carried without formal courier orders. CUI information may be disseminated to DoD personnel and DoD contractors to conduct official business for the program. If dissemination is required outside of DoD personnel or DoD contractors, contact the Government Security Manager for approval. Technical information will follow the release instructions identified in the Distribution Statement. Use secure communications whenever possible; however, land-line telephones are more secure than cellular telephones and should be used whenever available for discussions involving CUI. Transmit voice and facsimile transmissions only when you have a reasonable assurance that only authorized recipients will have access to the transmission. Digital transmission shall comply with the below:

All transmission and/or dissemination of CUI (i.e., email and file transfers) must use NIST/NIAP-approved cryptographic products/algorithms, e.g., DoD-approved Public Key Infrastructure Certification or DoD Safe Exchange at https://safe.apps.mil/. These are available at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm. This encryption requirement includes communications that contain passcodes to teleconferences or web conferences where there is a reasonable expectation that CUI may be discussed. When encryption is not available, a government collaborative suite (aka Integrated Digital Environment [IDE]) must be used to transmit CUI.

· Contractor-hosted collaborative suites may be used for digital transmission and/or dissemination of CUI by personnel not located on a government backbone (e.g., NIPRNET), provided the following conditions apply: 1) Use only NIST/NIAP-approved cryptographic products/algorithms. The latest validation lists may be obtained at http://iase.disa.mil/pki/eca or http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm; and, 2) FedRAMP Impact 4/5 environments authorized for CUI (https://marketplace.fedramp.gov/#!/products are used for all third party collaborative suites.

· Do not post CUI to web pages that are publicly available or have access limited only by domain/IP restrictions. As permitted by other contract provisions, CUI may be posted to web pages that control access through the use of a DoD approved Public Key Infrastructure Certification and that provide protection via use of secure sockets, or other equivalent technologies. These are available at http://iase.disa.mil/pki/eca.

· As new technologies become available in the electronics arena, care should be given to providing a reasonable degree of protection from known vulnerabilities.

· The Internet is “Public Access”. CUI must be reviewed and officially approved by the PEO GCS Public Affairs Officer for public release before placing on the Internet. This is not applicable when the Internet is used for e-mail transmissions and encryption is used as noted above.

Disposal: The contractor shall ensure any covered defense information provided by the Government under this contract is destroyed or sanitized from contractor owned media and reported in accordance with NIST SP 800-88, Rev 1, Guidelines for Media Sanitization , December 2014, and in accordance with Section 2002.14 of Title 32, CFR. Destroy CUI documents may be destroyed by means approved for classified information or by any other means making it unreadable, indecipherable, and unrecoverable.

Report of Loss of CUI: Report any loss of CUI to the Government Security Manager. Initial reports shall be made as expeditiously as possible in all cases within 72 hours of discovery. If additional information is required after submission and review of the initial report, guidance will be provided at that time. Initial report content shall include the following information as available.

· Applicable dates, including dates of compromise and dates of discovery

· Threat methodology, including all known resources used (e.g. IP addresses, domain names, software tools)

· Account of what actions the threat(s) may have taken on victim system/network

· What information may have been compromised or lost, and its potential impact on government programs

Revised June 8, 2021

Program Executive Office Ground Combat Systems (PEO GCS)

Operations Security (OPSEC) Plan

PREPARED BY: Security Office, PEO GCS, SFAE-GCS-CIO/MS 505, 6501 East Eleven Mile Road, Warren, MI 48397-5000

SUBMITTED BY

NANCY CHAPLIN Date OPSEC Officer

APPROVED BY

BRIAN P. CUMMINGS Date Major General, USA Program Executive Officer, Ground Combat Systems

22 May 2019

9 June 2019

CHAPLIN.NANCY.

A.1230490259

Digitally signed by

CHAPLIN.NANCY.A.1230490259

Date: 2019.05.22 14:29:59 -04'00'

CUMMINGS.BRIAN.P

ATRICK.1047098382

Digitally signed by

CUMMINGS.BRIAN.PATRICK.104709838

Date: 2019.06.09 11:52:09 -04'00'

PEO GCS OPSEC P lan June 2019 i

Table of Contents PEO GCS Mission Statement General OPSEC Definition OPSEC Concept OPSEC Compromise Penalties Responsibilities

Program Executive Officer OPSEC Officer as the PEO’s executive agent will -- PEO Public Affairs Officer (PAO) PEO Webmaster Program Managers All U.S. Personnel with access to PEO GCS CUI or classified information

OPSEC Considerations Critical Information OPSEC Measures

Administrative/Personnel OPSEC Awareness Conference Room Security Conferences and Symposia Teleworking Employee Travel Computer Security Media Networked Printers Compromising Emanations Waste Disposal Public Release Website OPSEC Reviews Unsolicited Requests for Information Shipment of Sensitive Materials Communications Security Insider Threat Document Markings CUI Protection Measures Visitor Control Escorts for Foreign Visitors Contractor Requirements

Annex A – The Multidiscipline Collection Threat Annex B – Vulnerability Assessment Annex C – OPSEC Checklist Annex D – Terms Annex E – References

PEO GCS Mission Statement Modernize, sustain and transform the Army's portfolio of premier ground combat systems.

General This publication specifically addresses the common features of a functional, active and documented Operations Security (OPSEC) program. This publication assigns OPSEC responsibilities and requirements within the Program Executive Office Ground Combat Systems (PEO GCS) to plan for and implement OPSEC; a systematic approach to developing necessary OPSEC measures; implementation of OPSEC training;

requirements for the review of OPSEC measures and reporting; and cross-command and interagency support to the PEO GCS OPSEC program, which includes reviews, assessments, and survey training. It is designed to provide a basic understanding of OPSEC functions and how to apply them within PEO GCS. OPSEC is applicable to all aspects of work, from daily routine planning through testing, exercise, and evaluation phases to force deployment, recovery, and reconstitution.

PEO OPSEC Officer: Nancy Chaplin, 586-282-9648

This OPSEC Plan documents the policies and procedures needed to meet the specific OPSEC program requirements of PEO GCS and to support the OPSEC programs of higher echelons.

The overall purpose of OPSEC is to strengthen our traditional security procedures by identifying existing vulnerabilities or weaknesses and applying measures to protect sensitive technologies. The goal is to deny our adversaries access to any critical information. Critical information includes technologies and information desired by an adversary that is sensitive and the disclosure of which could seriously impact our programs. Technology or information does not have to be classified to be of value to an adversary. An adversary can learn a lot about our programs by piecing together obtainable unclassified information. Therefore, in our attempts to shield our activities, it is not only important to follow normal security practices but also to implement OPSEC measures. This OPSEC Plan will discuss the five-step process: Identifying Critical Information, Analysis of Threats, Analysis of Vulnerabilities, Assessment of Risks, and the Application of OPSEC measures.

OPSEC applies to everyone within PEO GCS. All information identified as critical information will be reviewed for OPSEC before being released. All information, regardless of whether it is critical, will be reviewed for OPSEC before its release to the public in any manner.

OPSEC Definition OPSEC is a process of identifying critical information and subsequently analyzing friendly actions attendant to military operations and other activities to—

1. Identify actions that can be observed by adversary intelligence systems.

2. Determine indicators that hostile intelligence systems can obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries.

3. Select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation.

OPSEC Concept Many daily normal functions or may convey information and indicators to adversaries in spite of routine security measures (personnel, physical, document, cryptographic, computer) to protect classified information. Information available from detectable friendly activities, when combined with other information held by an adversary will, in unknown ways, shape the adversary's perceptions of friendly intentions, military capabilities, actions, and possible weaknesses, all of which will provide answers to adversary intelligence questions. During classified or sensitive unclassified activities (e.g., operations, exercises, field tests of military systems), are planned and executed, acting routinely can often result in adversaries gaining harmful appreciations by piecing together the various indicators.

Intelligence systems function worldwide. Even if PEO GCS is vigilant, other organizations that provide support may conduct activities that convey pertinent PEO GCS information or indicators of intentions, capabilities, limitations, and vulnerabilities.

Therefore, planning for primary and supporting operations and other activities (e.g., a test administered by the Army Test and Evaluation Command [ATEC]) must be systematically examined to determine potential disclosures that would cause cancellation or failure of the primary mission. Subsequently, one must plan and execute protective measures that permit operations and activities to proceed effectively while preserving requisite essential secrecy. OPSEC is the process designed to do this.

An OPSEC vulnerability exists when OPSEC indicators leading to critical information are collectable by adversary collection systems, the collected information can be processed, and the adversary has time to react in a way harmful to the United States.

The most serious problem facing PEO GCS in this respect is that critical information collected by an adversary today could in fact be used to develop a technological advantage for the adversary’s use many years in the future. Collection capabilities used to obtain information from accessible activities generally depend on some form of target cooperation. For example, throwing any information in the trash allows it to be retrieved by an adversary who will gain information about our activities, and releasing information into the public domain allows the adversary to obtain useable information at no risk to their assets. The detection of predictable actions depends on our acting in stereotyped ways and giving the adversary an advantage. Thus, if proper OPSEC measures are applied, it is often possible to eliminate or control many detectable indicators of critical information about our intentions, capabilities, and activities.

The key objective of OPSEC is to ensure mission effectiveness. Some protective measures to eliminate information conveyed by an activity may unacceptably reduce effectiveness. For example, telemetry and communications are often needed in tests;

and personnel, equipment, and material movements are unavoidable if operations and activities and to be executed. In these instances, it may be possible to deny information by acting against the collectors or analysts, rather than stopping the actions. Actions that may implemented include the use of jamming, obscurant, weather, camouflage, environmental conditions, covers, or military deception to influence adversary perceptions and conclusions (e.g., cover operations to explain observable activities, diversions to draw collection and analytical interest elsewhere, creating conditioning to cause activities to be ignored, multiple impressions to confuse interpretation of information). In Joint operations, OPSEC is an element of command and control warfare. Countering the adversary command and control, and protecting friendly command and control are functions of OPSEC.

Planning for secrecy must extend beyond exposure of raw information and consider possible assumptions and estimates made by an adversary. Logical conclusions based on generally available information, trend analysis based on historical data or technical possibilities, and broad experience of adversary planners and decision-makers must be factored in to planning. Military deception may be required to mislead adversary analysts in order to maintain essential secrecy.

The following are examples of unclassified information that are indicators that could alert or key an adversary to the existence of a classified project, existence or application of advanced technology, or a new tactic or technique unknown to adversaries:

Unclassified agreements between government agencies or their association in a project or operation that outlines methods, procedures, and current U.S.

Government intentions or future objectives.

Special or unique requests providing special instructions that could reveal capabilities or the technology of a new weapon system.

Public relations release describing aspects of technological or operational cooperation between the U.S. and other nations.

Announcements of formation of specialized groups, special elements, or organizations, which could signal special intentions, activities, or capabilities.

Consolidated budget execution for specific projects, testing of items or tactics, and monies spent that are intended for future acquisition.

OPSEC Compromise An OPSEC compromise is the disclosure of critical or sensitive information that jeopardizes PEO GCS’s ability to execute its mission or to adequately protect its personnel or equipment. Good OPSEC practices can prevent these compromises and allow us to maintain essential secrecy about our operations.

Critical or sensitive information that has been compromised and is available in open sources and the public domain should not be highlighted or referenced publicly outside of intragovernmental or authorized official communications, because these actions provide further unnecessary exposure of the compromised information. Report any known or suspected OPSEC compromise to the PEO Security Office immediately.

Penalties Failure to comply with OPSEC orders, directives, or policies may be punished as violations of a lawful punitive order under Article 92 of the Uniform Code of Military Justice (UCMJ) (Reference (a)) or under other disciplinary, administrative, or other actions as applicable. Personnel not subject to the UCMJ who fail to protect critical and sensitive information from unauthorized disclosure may be subject to administrative, disciplinary, contractual, or criminal action.

Responsibilities Every individual is ultimately responsible for the security of the information to which he or she has access. Each piece of information that an adversary can get access to fills in one more piece of the puzzle as it relates to our overall plan of action.

Program Executive Officer

Issue orders, directives, and policies to protect PEO GCS critical and sensitive information to clearly define the specific OPSEC measures that all PEO personnel should practice.

Ensure that the OPSEC program and OPSEC measures are coordinated and synchronized with security programs, e.g., information security (INFOSEC), information assurance (IA), physical security, and force protection.

Ensure that all official information released to the public, to include information released on the World Wide Web, receives an OPSEC review prior to dissemination.

Establish a documented OPSEC program that includes as a minimum, OPSEC Officer appointment orders and an OPSEC Plan.

Appoint an OPSEC officer in writing with responsibility for supervising the execution of proper OPSEC within the organization.

Ensure that the appointed OPSEC Officer is of appropriate grade or rank, and receives appropriate training in accordance with (IAW) Chapter 4, Army Regulation (AR) 530-1, (Reference (h)).

Approve the PEO GCS Critical Information List (CIL) and circulate it to all subordinates as widely as security permits.

Provide guidance and direction to ensure that each subordinate organization understands, adapts, and applies the CIL to its mission and provides feedback.

Weigh the risk in the mission against the costs of protection and decide what OPSEC measures to implement; and publish such measures in the OPSEC Plan.

OPSEC Officer as the PEO’s executive agent will --

Direct and implement the OPSEC program.

Plan for and implement OPSEC before, during, and after operations and other activities, including RDT&E that affect the combat capability of the Army; ensure that OPSEC is part of the initial planning guidance.

Chair the OPSEC Working Group (OWG) to coordinate OPSEC actions on a consistent basis.

Develop the CIL in conjunction with other subject matter experts.

Develop and recommend OPSEC measures to be implemented.

Conduct OPSEC reviews of operational plans and reports to ensure adherence to OPSEC policies and procedures.

Conduct OPSEC assessments of PMOs using the published OPSEC guidance to determine whether the PMO is implementing PEO-directed and their own OPSEC policies and procedures.

Coordinate with the Public Affairs and Freedom of Information Act (FOIA) Officers to ensure that information is reviewed for OPSEC before being released.

Ensure that all OPSEC training is IAW AR 530-1 (Reference (h)) and this OPSEC Plan.

Integrate intelligence, counterintelligence, and force protection into OPSEC planning and practice.

Prepare the annual OPSEC Report.

Perform other duties and responsibilities as defined in AR 530-1, Appendix H (Reference (h)).

Provide quarterly reminders of the importance of sound OPSEC practices, including but not limited to OPSEC news releases in publications, OPSEC information bulletins, and OPSEC awareness briefings.

PEO Public Affairs Officer (PAO)

Comply with Federal, Department of Defense (DoD), and Department of the Army (DA) website administration policies and implementing content-approval procedures that include OPSEC.

Consider OPSEC in preparation of all public releases of official information.

Coordinate with the OPSEC Officer before updating or posting information on all Web sites, IAW AR 25-2 (Reference (d)) paragraph 4-20.g.(11).

Ensure the office providing the information, materials, or records to the PAO for release should accomplish OPSEC reviews IAW AR 360-1 (Reference (e)), paragraph 5-4.

Ensure that in addition to the OPSEC Officer, the webmaster and other appropriate designees (e.g., command counsel, force protection, intelligence) have properly cleared information prior to posting to the web, unclassified intranet, or to Army Knowledge Online (AKO) areas accessible to all account types.

Coordinate directly with the OPSEC Officer on all questionable releases and for additional guidance on any release.

Ensure that all military, civilian, or contractor personnel who post or maintain information (e.g., documents, spreadsheets) in the public domain for official PEO GCS purposes (also including OPSEC Officers and PAO personnel) complete “Social Media and Operations Security” training at Information Assurance Training Center or DISA’s Social Network Course; or such similar courses that may be required in the future.

PAOs and other personnel who interact with the public on a regular basis will received external official presence training or attend a Level II OPSEC officers course, IAW AR 530-1 (Reference (h)), paragraph 4-2.b.(2).

Be the primary spokesperson to the news media in the event an antiterrorism incident or work in conjunction with the installation public affairs office, IAW AR 525-13, (Reference (g)).

Provide unclassified information about the Army and its activities to the public with maximum disclosure and minimum delay. Do not release information that would adversely affect national security, threaten the personal safety, or invade the privacy of members of the Armed Forces, IAW AR 360-1 (Reference (e)), paragraph 2-3.d.(5).

PEO Webmaster

Comply with Federal, DoD, and DA web site administration policies and implement content-approval procedures that include OPSEC and PAO reviews before updating or posting information on all websites IAW AR 25-2 (Reference (d)) paragraph 4-20,g.(11).

Conduct annual OPSEC reviews of all organizational web sites and provide these results to the OPSEC Officer for inclusion in the annual OPSEC report IAW AR 25-2 (Reference (d)) paragraph 4-20.g. (15).

Coordinate directly with the OPSEC Officer for additional guidance on any questionable web site posting.

Take the Social Media and Operations Security training course at Information Assurance Training Center or DISA’s Social Network Course.

Program Managers

Implement an OPSEC program.

Approve the PM’s OPSEC Plan.

Appoint an OPSEC officer in writing with responsibility for supervising the execution of proper OPSEC within the organization.

Ensure appropriate OPSEC measures are taken within the PMO to preserve essential secrecy.

Ensure appropriate OPSEC measures are taken in order to provide maximum protection of all functions and activities.

Assist the OPSEC Officer with integrating OPSEC into all organizational activities.

Plan for and implement OPSEC before, during, and after operations and other activities, including RDT&E that affect the combat capability of the Army; ensure that OPSEC is part of the PM’s initial planning guidance.

All U.S. Personnel with access to PEO GCS CUI or classified information

Implement OPSEC measures as identified in this plan.

Receive Operations Security Level I training IAW AR 530-1, (Reference (h)) Chapter 4, to— o Understand how OPSEC complements traditional security programs to maintain essential secrecy of U.S. military capabilities, intentions, and plans.

o Learn how to apply OPSEC to daily tasks.

o Learn why OPSEC is important to the organization.

o Understand how adversaries aggressively seek information on U.S.

military capabilities, intentions, and plans.

o Become knowledgeable of the CIL and how to protect it by applying

OPSEC measures to prevent inadvertent disclosure.

Be familiar with this OPSEC Plan and where to obtain additional OPSEC guidance if needed.

Maintain need-to-know and telephone security.

Limit distribution

Do not talk about work in public locations.

Safeguard unclassified technical data.

Handle any attempt by unauthorized personnel to solicit sensitive or critical information as a TARP incident per AR 381-12 (Reference (f)). Report all facts immediately to the nearest supporting counterintelligence office and inform the chain of command.

OPSEC Considerations OPSEC must be considered when preparing policies, procedures, and doctrine; when designing systems; and when prescribing logistic and administrative practices.

Policies, procedures, and doctrines govern the freedom of action of commanders and can introduce a degree of rigidity in the way functions are performed. Over time, the constraints imposed on commanders and procedural habits will become apparent, allowing adversaries to better predict what commanders will or will not do and how various functions will be carried out.

Systems and tactics are of little value if during their development, an adversary develops the capability to locate, track, identify, target, and destroy that system or counter the tactic when it is deployed or implemented. Administrative and logistic practices are generally overt and can reveal information of considerable value to an adversary. Standard ways of executing tasks make it simple to detect changes in routines, or against a specific background, to detect capabilities being readied for use.

Critical Information Critical information consists of specific facts about friendly intentions, capabilities, and activities vitally needed by adversaries for them to plan and act effectively to guarantee failure or unacceptable consequences for friendly mission accomplishment.

The OPSEC Officer, in conjunction with a working group, develops the PEO GCS overall CIL, which is then approved by the PEO. The PEO’s intent is that all personnel—military, civilian, and contractors—are aware of the organization’s critical information so they can better apply OPSEC to their daily tasks.

The overall PEO CIL is as follows:

Vulnerabilities and limitations in weapons and weapons systems – Operational limitations (weather, terrain); reliability or effectiveness of the weapon system; lack of performance or identification of damage against threat (e.g., ballistic, non-ballistic, nuclear, chemical, biological, electronic warfare)

Weapons systems development schedules below summary – Specific date, time, or location information prior to and during the event

Emerging technologies applicable to new weapons systems Custom computer software used in weapons systems development, testing and evaluation Identification of Critical Program Information (CPI) and Program Protection

Plan (PPP) implementation methods – Location of CPI within the weapon system; identification of contractor developing CPI; protection measures implemented to protect CPI and critical functions of the weapon system

Specifics or requirements of the program in acquisition – Threshold and Objective specifications and technical performance measures

Preliminary programmatic and resourcing decisions not yet approved by the Army – Program or contract cancellations; pre-Program Objective Memorandum (POM) or Budget Estimate Submission (BES) lock budget data;

shortfalls in meeting program cost, schedule, and performance thresholds

Classification levels of the program – Special Compartmented Information (SCI) and Special Access Program (SAP) accesses; Security Classification Guide (SCG) identifies classified critical information; Department of Defense (DD) Form 254, if addressing SCI or SAP

OPSEC Measures OPSEC measures are in place to protect identified critical information. OPSEC measures reduce the probability of the adversary either collecting the indicators or being able to correctly analyze their meaning. There are three main categories of OPSEC measures:

1. Action Control: Internal actions to eliminate the indicators or vulnerabilities -attack the adversary’s collection system

2. Countermeasure: Disrupt effective adversary collection - prevent the adversary from detecting an indicator.

3. Counteranalysis: Prevent accurate interpretations of what is seen - provide an alternative analysis of an indicator.

Example: Access control devices are physical security devices, but they rely on personal security procedures to dictate who should be allowed entry and who should be denied. Access control devices also rely on employee compliance with procedures to walk through such devices and to identify themselves by badge, ID number, or biometric measurements. If the employees do not uniformly comply with these procedures, the device is not effective. If an analyst accepts that the presence of access control hardware is by its very presence effective, he or she will have missed the true vulnerabilities in its effectiveness.

Information can be compromised in a variety of ways. Security education emphasizes the threat of overt and clandestine intelligence collectors. Conversations at work and off the job must not pertain to subjects that listeners do not have a need to know.

Information security is of vital importance to the PEO GCS OPSEC program. Security procedures, such as using only approved storage containers, double-checking offices before departure, having a clean desk policy, and ensuring need to know are some of the measures that will be taken to protect classified and sensitive program related information.

The measures identified here are not all-inclusive of those practiced in PEO GCS.

OPSEC measures in this section apply to all personnel at all operating locations. The

OPSEC measures outlined in this section are designed to eliminate, reduce, or counter the possible vulnerabilities identified earlier in this plan.

Administrative/Personnel

Vulnerability or Potential Threat OPSEC measure

Loss of information

An aggregation/compilation of information could lead to a compromise of classified

Unauthorized personnel can see or overhear information (obtain information) while walking through areas to attend meetings.

Posting CUI (technical data or FOUO) in cubicles can be observed by visitors.

Data on glass walls/partitions and monitors can be…