Attachment_3_-_S_T_PROTECTION_IMPLEMENTATION_PLAN__PIP__TEMPLATE.docx

INSERT CLASSIFICATION

S&T Protection Implementation Plan Insert Company Logo

Classified By: Click or tap here to enter text.

Derived From: Click or tap here to enter text.Controlled by:

CUI Category: OPSEC Distribution: FEDCON

POC:

Declassify On: Click or tap to enter a date.

(U) FOREWORD

(CUI at minimum) This S&T PIP outlines [insert performer name] implementation of P2 strategies to protect critical technologies associated with [insert DARPA Tech Office and Project Name]. [DARPA Project Name] is a [insert CUI, Collateral, SAP, SCI, or combination] project.

(U) This document will be updated periodically and reviewed by the CPSO and CPM at least annually and at key program milestones to ensure it continues to capture the current program mission and objectives as well as the threat level and vulnerabilities to critical program information. This will allow the team to adjust needed countermeasures to protect this information.

(CUI at minimum)It is important to note that this outline is expected to be tailored to the program. Sections that are not used/needed will be marked “Not Applicable” so that they are available for future consideration as the program evolves and periodic updates are made to the [insert performer name][DARPA Project Name] S&T PIP.

(U) Table of Contents

11. (U) Other Addenda as Required………………………………………………………………..……….7

(U) References

(U) DoD Instruction 5200.39, Critical Program Information (CPI) Identification and Protection within Research, Development, Test, and Evaluation (RDT&E), Change 2 dated 15 Oct 2018

(U) DoD Instruction 5000.48, Controlled Unclassified Information (CUI), March 6, 2020

(U) DoD Instruction 5000.83, Technology and Program Protection to Maintain Technological Advantage, dated 20 Jul 2020

(U) DARPA CG-XXXX, “Name”, Month, day, year

(U) DARPA CUI Guide, “Name”, month, day, year

1.0 (U) Executive Summary and Assumptions

(U) The prime contractor will outline their protection strategy and assumptions in the Executive Summary section. This should be 1-2 paragraphs that give the Program Manager (PM), Program Security Officer (PSO) or Special Access Program Central Office (SAPCO) a snapshot of the plan, intended outcomes, measures of success, and key assumptions.

2.0 (U) S&T Protection Critical Events

2.1 (U) Schedule: (This is the Integrated Master Schedule that shows S&T Protection Milestones such as S&T Protection Working Group, key POCs etc…)

3.0 (U) Critical Program Information (CPI) and Critical Components

3.1 (U) CPI and Critical Components: List CPI and Critical Components here; components that are considered under a CUI category should be reviewed for inclusion

Protected Item (Inherited and Organic) Countermeasures

Key

Key X = Implemented I = Denotes protection already implemented if CPI is inherited 1 Personnel Security 2 Physical Security 3 Operations Security 4 Industrial Security 5 Training 6 Information Security 7 Foreign Disclosure Agreement 8 Transportation Management 9 Anti-Tamper 10 Dial-down Functionality 11 IA/Network Security 12 Communications Security 13 Software Assurance 14 Supply Chain Risk Management/Manufacturing Plan 15 Systems Security Engineering (SSE) 16 Other

3.2. (U) Protected Item table:

3.3 (U) Protected Item Location and Explanation of Mitigations: The prime contractor will list the team members who will work on Program XX, what their responsibilities are, and where the Program XX CPI and Critical Components will be located throughout the life of the program. This should include a matrixed table or descriptive paragraph that explains how each identified risk is mitigated at the team locations.

4.0 (U) S&T Protection Risks: Ensure that all elements listed in section 3 “P2 Challenges” of the S&T Protection Plan provide by DARPA are addressed below or a note indicating where they are addressed elsewhere in your protection plan is included.

4.1 (U) Threat to the Technology: The Prime Contractor should leverage available DCSA and/or FBI threat assessments and reports to identify location-specific threats as well as threats relevant to program technology thrust(s). This data is useful to capture threats in order to ensure mitigation and containment strategies are properly aligned to reduce risk

4.2 (U) Observables Identification and Containment: The Prime Contractor will describe their process for integration of OPSEC and other program-related observables into the S&T Protection Process, and provide mitigation strategies for these observables.

4.3 (U) Description of Work being performed at lower classification levels: The Prime Contractor will describe their process protecting program information when leveraging unclassified or lower classified work in support of the DARPA XX program. Include unclassified subcontractor or vendor relationships/work and the associated risk in support of the DARPA XX program.

4.4 (U) Program Risk Management: The Prime Contractor will describe how S&T Protection risks (cost, schedule, technical) will be integrated with the overall program risk management.

5.0 (U) Program Financial / Procurement Requirements:

(CUI) The prime contractor will identify key program financial and procurement observables specific to this program, and identify containment strategies to prevent these issues from compromising the S&T protection strategy and revealing a capability critical to national security.

6.0 (U) Foreign Involvement

7.0 (U) Processes for Management and Implementation of the S&T PIP (The contractor should describe the continuous monitoring process of the S&T PIP)

8.0 (U) Monitoring and Reporting Unauthorized Disclosure or Compromise (CUI) The prime contractor will detail their monitoring strategy for program observables, and identify how they will prevent unauthorized disclosure or compromise through protection planning strategies to support their entire team (to include subcontractors and vendors).

9.0 (U) Program Material Disposition Requirements:

9.1. (CUI) Material Disposition: The prime contractor will articulate disposition of material X in accordance with federal and state safety guidelines to include any coordination with the Defense Contracts Management Agency (DCMA).

9.2. (CUI) Material Archival: The prime contractor will describe procedures to ensure that if not required by the transition partners, the operational prototype will be kept for program disposition until the end of contract and shipped/couriered to DARPA IAW with PSO guidance.

9.3. (CUI) Information System Disposition: The prime contractor will articulate disposition of information systems in accordance with guidance outlined in the applicable contract DD Form 254.

10.0 (U) Definitions

(U) Countermeasures: The employment of devices or techniques that impair the operational effectiveness of enemy activity. Countermeasures may include anything that effectively negates an adversary’s ability to exploit vulnerabilities.

(U) Critical Component: A subsystem, assembly, or component of a system that itself delivers mission-critical functionality to the system, or that may, by virtue of system design, expose vulnerability in the mission-critical functions of other components within the system.

(U) Critical Program Information (CPI): CPI are U.S. capability elements that contribute to the warfighters’ technical advantage, which if compromised, undermines U.S. military preeminence. U.S. capability elements may include, but are not limited to, software algorithms and specific hardware residing on the system, its training equipment, or maintenance support equipment.

(U) Inherited CPI: CPI that is owned and generated by one RDT&E program, subsystem, or project, and is incorporated into, and used by, another RDT&E program.

(U) Organic CPI: Unique CPI that is owned and generated by an RDT&E program.

(U) Risk: A future event or condition that may have a negative effect on achieving program objectives for cost, schedule, or performance. Risk are defined by (1) the probability of an undesired event or condition, and (2) the consequences, impact, or severity of the undesired event if it were to occur.

(U) Risk Management: The process of identifying, assessing, and controlling risks by making decisions that balance risk costs with mission benefits. Costs may be measured in financial cost, loss of asset, loss of information, or loss of reputation.

(U) Technical Decomposition: Method of analysis that breaks down a complex process or system by means of its functions in a hierarchal manner to identify critical components potentially requiring enhanced protection.

(U) Threat: An assessment of foreign adversary interest and skill in obtaining CPI.

(U) Unauthorized Disclosure: A communication or physical transfer of non-public information, controlled unclassified, or classified information to an unauthorized recipient.

(U) Vulnerability: A condition enabling an adversary to collect, analyze, and react to critical information or indicators.

11.0 (U) Other Addenda as Required

INSERT CLASSIFICATION

image1.png