Attachment 1- DD 254_Certified N66604-23-R-0285.pdf

DEPARTMENT OF THE NAVY

NAVAL UNDERSEA WARFARE CENTER DIVISION

1176 HOWELL STREET

NEWPORT RI 02841-1708

IN REPLY REFER TO:

Ser 105/156

10 AUG 22

From: Commanding Officer, Naval Undersea Warfare Center Division, Newport

Subj: NAVAL UNDERSEA WARFARE CENTER DIVISION, NEWPORT CRITICAL

INFORMATION AND INDICATORS LIST

Ref: (a) DODM 2505.02, DoD Operations Security Program Manual, CH-1, of 26 April 2018

(b) SECNAVINST 3070.2A

(c) NAVSEAINST 3432.1

(d) NUWC Division Newport Security Manual of December 2019

(e) NUWC Division Newport Critical Information List of April

1. To maintain effective Operations Security (OPSEC) per references (a) through (d), it is necessary to create a Command Critical Information and Indicators List (CIIL) and protect the CIIL content from discovery and/or exploitation by our adversaries. The list below is an overview of our CIIL.

Specialized programs/projects will likely have more specific CIIL identified for small groups of users assigned to their respective programs/projects.

2. References (a) through (c) define CIIL as essential facts, elements, or components of a research, development, acquisition, test and evaluation program that, if compromised, could:

a. Cause significant degradation in mission effectiveness;

b. Shorten the expected combat-effective life of the system;

c. Reduce technological advantage;

d. Significantly alter program direction; or

e. Enable an adversary to defeat, counter, copy, or reverse engineer the technology or capability.

3. Naval Undersea Warfare Center Division, Newport (NUWCDIVNPT) Military, Civilian, and seated Contractors are required to become familiar with the Command CIIL; in addition, the CIIL should be posted in visible locations throughout work centers.

4. Upon signature, reference (e) is cancelled.

5. The following CIIL, derived from references (b) and (c) and augmented with NUWCDIVNPT-specific items, identifies classified and critical unclassified information requiring application of OPSEC Measures:

Subj: NAVAL UNDERSEA WARFARE CENTER DIVISION, NEWPORT CRITICAL

INFORMATION AND INDICATORS LIST

- Restricted access areas and information technology (IT) system passwords, tokens, authentication codes, etc.

- Cybersecurity measures: Computer passwords, user/log-on identifiers, system and network access paths, etc.

- Official Command activities or operations not yet released through Public Affairs channels.

- Threat analysis and risk assessment results, to include implemented counter measures.

- Emergency operating and continuity of operations procedures and emergency actions.

- Identification, strength, operational readiness, or combat support limitations of assigned forces.

- Specific characteristics, capabilities, limitations or weaknesses of specific weapons, payloads, systems, cybersecurity or platforms.

- Status of critical communications frequencies, links, paths, or network transmission systems.

- Proprietary/sensitive data (i.e., trade secrets, confidential, or financial info) of contract officers.

- Security, network architecture, topology, infrastructure, and design risk assessment results.

- Identification of specific assets, facilities, systems, and network critical infrastructure.

- Schematics, floor plans, diagrams of NUWCDIVNPT facilities.

- Personally Identifiable Information and/or personnel data covered by the Privacy Act.

- Personally Identifiable Information of personnel that could be used by adversaries for passive or active targeting, like recall rosters, key personnel lists, and emergency contact information listing personal phone/home address.

- Results of inquiries/investigations/audits into cyber intrusions of IT networks/systems.

- Finance audits/Anti-deficiency Act violations exposing fraud, waste, abuse, or mismanagement.

- Reportable conditions and material weaknesses revealed during inspections and assessments.

- Impending litigation, confidential Inspector General Actions, and ongoing investigations.

- Photos/images taken from within restricted/controlled access areas, unless approved for release. Photos/images containing any security features (e.g., guard shack, barriers, uniformed guards, access badges, safes, locking mechanisms, weapons, security cameras, etc.).

- Physical security, communications security and/ or cybersecurity protocols and/or weaknesses.

- Performance levels of fleet assets in critical areas (i.e., silencing, signatures, acoustics, etc.)

- Travel itineraries of key Command personnel, such as Senior Executive Service/Commanding Officer/Enterprise Directors.

6. For questions concerning this CIIL or OPSEC, please contact Mr. Charles Morrison, NUWCDIVNPT Operations Security Program Manager at, 401-832-5462 or Charles.a.morrison6.civ@us.navy.mil.

C. F. HENNINGS

Copy to:

Distribution:

NAVUNSEAWARCENDIV NEWPORT

NAVUNSEAWARCEN DET MANASSAS, VA

NAVONSEAWARCEN 080 OKAHUMPKA, FL

NAVUNSEAWARCEN TECHREP OFFICE SYLAMR, CA

NAVUNSEAWARCEN OSO WILLIAMSBURG, VA

NAVUNSEAWARCEN DET FEO NORFOLK, VA

NAVUNSEAWARCEN DET BANGOR, WA

NAVUNSEAWARCEN OSO KINGS BAY, GA

NAVUNSEAWARCEN DET AUTEC WEST PALM BEACH, FL

NAVUNSEAWARCEN DET AUTEC ANDROS ISLAND, BAHAMAS

NAVUNSEAWARCEN OSOSESEF MAYPORT, FL

NAVUNSEAWARCEN OED DRESDEN, NY

NAVUNSEAWARCEN OSOSESEF VIRGINIA BEACH, VA

NAVUNSEAWARCEN OSONIANTIC, CT

NAVUNSEAWARCEN OSOKEYPORT, WA

NAVUNSEAWARCEN ROTA, SPAIN

FOR OFFICIAL USE ONLY

OPSEC: SECMAN Chap. 12

OPERATIONS SECURITY (OPSEC) CHAPTER 12 FROM

NUWCDIVNPT COMMAND SECURITY MANUAL

NAVAL UNDERSEA WARFARE CENTER

DIVISION, NEWPORT

Distribution authorized to U.S. Government agencies and supporting contractors participating in DoD Defense Continuity Program activities; Administrative or Operational Use; 15 Nov 2019. Other U.S. requests for this document shall be referred to the Security, Naval Undersea Warfare Center, Division Newport, 1176 Howell Street, Newport, Rhode Island 02841.

11 Dec 2019

CHAPTER 12

OPSEC

12.1 Purpose. This chapter establishes policy, responsibilities, management structure, and guidance for implementing and managing NUWCDIVNPT OPSEC Program following the guidance and procedures set forth in DOD and DoN guidance.

12.2 Cancellation. Effective immediately, NUWCDIVNPTINST 3070.lB is cancelled.

12.3 Applicability

a. The mission of NUWCDIVNPT is to support NUWC by providing research, development, test evaluation, engineering and fleet support for submarines, autonomous underwater systems, undersea offensive and defensive weapon systems and countermeasures associated with undersea warfare.

b. NUWCDIVNPT's unique mission and overall strategy dictate that we strictly adhere to

OPSEC policy and procedures in order to achieve operational superiority. As such, the provisions of this instruction apply to all NUWCDIVNPT activities to include NUWCDIVNPT Rhode Island and all its detachments, ranges and laboratories; collectively referred to hereafter as

NUWCDIVNPT.

c. NUWCDIVNPT will fully implement the OPSEC program to ensure practices are used to deny Critical Information to any potential adversary.

d. All military, civilian, and "seated" contractor personnel, assigned or attached to NUWCDIVNPT are required to read, understand, and fully comply with this chapter.

e. The OPSEC Program Manager (PM), and all OPSEC Coordinators must be familiar with the policy, guidance, and best practices delineated in references (a) through (ff).

12.4 Background. OPSEC is the process that denies adversaries information about our activities, capabilities, and intentions by protecting relevant indicators and observables. The National OPSEC program was established and based on the recognition that, even though security programs and procedures to protect classified matters exist, unclassified information and certain detectable operational activities can reveal the existence of, and sometimes details about, classified or unclassified sensitive or critical information or activities. What may have once been considered innocuous activities outside the scope of traditional security programs, are now recognized to provide detectable indicators of friendly intentions and other critical information. OPSEC ties together all the elements of a comprehensive security program and forms the basis for effective, overall security program management. OPSEC measures will be used to protect classified and unclassified sensitive or critical efforts from adversary intelligence collection activities. OPSEC protects sensitive or critical information by preventing detection, impairing observation, and thwarting interpretation by known or potential adversaries. Routinely applying OPSEC in daily operations or during the planning phase of any event or operation will greatly enhance NUWCDIVNPT's effectiveness in protecting relevant critical information.

12.5 Program. The NUWCDIVNPT OPSEC program and its functions reside in the Special

Programs Branch (Code 1053) of Security (Code 105) within Corporate Operations (Code 10).

a. The NUWCDIVNPT OPSEC Program Manager (PM) is the primary source of OPSEC support and has OPSEC oversight responsibility for NUWCDIVNPT.

b. The Naval OPSEC Support Team (NOST), Navy Information Operations Command Norfolk, is available to assist all naval commands in establishing or improving their OPSEC programs. The NOST can be contacted at opsec@navy.mil.

c. National-level OPSEC support can be received by the Interagency OPSEC Support Staff

(IOSS), which is established and maintained by the National Security Agency. The IOSS can be reached at https://www.iad.gov/ioss.

12.6 Responsibilities

a. CO, NUWCDIVNPT (Code 00) will:

(1) Designate an OPSEC PM in writing that meets the requirements of reference (c). The PM must have sufficient resources, staff assistance, and authority to implement, manage, and execute effective OPSEC programs;

(2) Validate command critical information and indicators, and program for and implement

OPSEC measures to protect critical information and indicators related to programs and activities under their purview;

(3) Approve the command's Critical Information List (CIL);

(4) Establish an OPSEC Working Group (WG) with representation from each department and encourage inclusion of representatives from Public Affairs, PHYSEC, Anti-Terrorism/Force Protection, and the Command XO.

b. The OPSEC PM will:

(1) Administer NUWCDIVNPT OPSEC program and make OPSEC recommendations to the

NAVSEA HQ OPSEC PM;

(2) Attend the Navy OPSEC PM course (J-20-0966) or the interagency OPSEC PM courses (OPSE-2380, OPSE-2390) offered by the Interagency OPSEC Support Staff (IOSS);

(3) Ensure initial and annual refresher OPSEC training is provided to all command personnel.

Records will be maintained by the command training office;

(4) Ensure all command personnel are knowledgeable of their respective CIL and OPSEC measures in place to protect the critical information;

(5) Develop the command's CIL, ensure it is approved by the CO, and provide a copy to the

NAVSEA OPSEC PM;

(6) Conduct annual OPSEC assessments and program reviews, and send copies of results to the NAVSEA HQ OPSEC PM;

(7) Coordinate with traditional security disciplines (information, personnel, physical) program managers;

(8) Compile command input for the annual Under Secretary of Defense for Intelligence OPSEC questionnaire and submit to the NAVSEA HQ PM when required;

(9) Ensure NAVSEA OPSEC requirements are implemented;

(l0) Coordinate, schedule, and hold periodic OPSEC WG meetings;

(11) Participate in the review process of information for public release with the Public Affairs

Officer; and ensure decisions regarding release of information into the public domain will include a review by an appropriately designated and trained OPSEC professional;

(12) Ensure all contracts include OPSEC requirements as appropriate. Classified contracts will include OPSEC requirements within the DD-254. Unclassified contracts will include OPSEC requirements;

(13) Conduct outreach, when appropriate, to ensure family members are familiar with the significance of protecting Critical Information;

(14) Maintain an OPSEC turnover binder or electronic folder located on the OPSEC PM's work center shared drive.

c. Program Managers and Contracting Officers will ensure classified and unclassified contracts address OPSEC requirements and responsibilities, and include OPSEC Plans, when applicable.

12.7 OPSEC Working Group. Per reference (h), each department must assign an OPSEC coordinator to participate in the OPSEC WG and assist the OPSEC PM in the execution of the command's OPSEC Program. Other attendees should include representatives from Public Affairs, PHYSEC, Anti-Terrorism/Force Protection, NCIS, XO and NAVSTA Newport OPSEC PM.

Additional duties and responsibilities include:

a. Assist the OPSEC PM in ensuring the accomplishment of all OPSEC related matters within their respective departments;

b. Provide necessary liaison to other OPSEC WG members in the accomplishment of the command's OPSEC program;

c. Remain actively engaged in annual assessments, training, awareness campaigns, and other

OPSEC tasks;

d. Attend regularly-scheduled OPSEC WG meetings;

e. Complete the OPSEC Fundamentals Course (OPSE-1301) computer based training provided by IOSS within 30 days of appointment to the WG, and if possible, complete OPSEC and Public

Release Decisions (OPSE-1500) and OPSEC and Internet Based Capabilities Course (OPSE-3500);

f. Ensure OPSEC measures and countermeasures are implemented in their respective departments.

12.8 Individual Command Members. All military, civilian, and "seated" contractor personnel will complete annual OPSEC awareness training, implement required OPSEC measures, and report potential compromises or previously unidentified vulnerabilities of critical information and indicators. Other personnel in the command knowledgeable in areas impacting or supporting OPSEC are welcome to assist the OPSEC PM and OPSEC Coordinators. All NUWCDIVNPT military, civilian, and "seated" contractor personnel must become thoroughly familiar with this chapter and comply with OPSEC policies, procedures, and plans. Recommendations for improvement should be addressed to the OPSEC PM or the respective WG members.

12.9 Integrating OPSEC into Contracts

a. Per reference (b), COs must ensure that contractors supporting DoD activities use OPSEC to protect critical information for specified contracts and subcontracts. Per reference (c), OPSEC will be stipulated in all contracts; the requiring organization and Government Contracting Activity (GCA) will impose OPSEC measures as contractual requirements, as necessary.

b. All involved in the contracting and acquisition process should be knowledgeable of OPSEC-related contract requirements and establish compliant procedures. Basically:

(I) Every contract does not require an OPSEC Plan;

(2) When a contract involves classified, critical, or sensitive information an OPSEC Plan may be required;

(3) When an OPSEC Plan is required there are three basic courses of action:

(a) Include the requirement for OPSEC Plan development in the Request For Proposals for potential bidders to consider or include in their bid. In this case, the Contractor would be developing an OPSEC Plan that they will implement or execute; this increases USG costs but would reduce GCA efforts.

(b) GCA creates the OPSEC Plan for the bidder to implement and execute. In this case, the

NUWCDIVNPT OPSEC PM would assist the designated GCA OPSEC official to develop an OPSEC Plan; this increases GCA efforts but reduces USG costs.

(c) When a contract will take place on NUWCDIVNPT ("seated" contractors) or one of its attachments, the contract will utilize the NUWCDIVNPT OPSEC program.

c. All contracts must be reviewed by the NUWCDIVNPT OPSEC PM or a trained representative.

(1) NUWCDIVNPT Process. The DD Form 254 (DD254) - Contract Security Classification Specification - conveys security requirements, classification guidance, and provides the handling procedures for classified material received or generated on a classified contract. The Federal

Acquisition Regulation requires that DD254s be integrated in each classified contract.

(2) Once DD254s are received at the Information and INDSEC Division and processed internally, the Information and INDSEC Division will pass the DD254 to the OPSEC PM. The OPSEC PM reviews the DD254s and the attached OPSEC Plans to ensure they properly reflect and address OPSEC concerns, meet OPSEC requirements, and delineate OPSEC responsibilities or actions. When the OPSEC review is complete, the OPSEC PM returns the DD254 to the Information and INDSEC Division.

(3) Prior to creation of the DD254, however, the OPSEC PM can assist GCAs in understanding the OPSEC process, identifying Critical Information, proposing measures to protect that Critical Information, and developing an OPSEC Plan. Developed OPSEC Plans for contracts.