Attachment 6 - OPSEC Requirements.pdf

DD 254 OPSEC Attachment

Current as of August 2017

NSWCCD OPERATIONS SECURITY (OPSEC) REQUIREMENTS

1. All work is to be performed in accordance with Department of Defense (DoD) and Department of

Navy (DON) Operations Security (OPSEC) requirements, per the following:

a) DoDD 5205.02E, DoD Operations Security (OPSEC) Program

b) DoD 5205.02M, DoD Operations Security (OPSEC) Program Manual

c) SECNAVINST 3070.2, Operations Security

d) OPNAVINST 3432.1A, DON Operations Security

e) NAVSEAINST 3432.1A, NAVSEA OPSEC Policy

f) CARDEROCKDIVINST 3070.1, NSWCCD OPSEC Program

2. The contractor will accomplish the following minimum requirements in support of Naval Sea Systems Command (NAVSEA) OPSEC Program:

a) Determine Critical Information (Cl) in accordance with DoD 5205.02m (App 1 to Encl 3). CI includes those facts, which individually, or in the aggregate, reveal sensitive details about

NAVSEA or the contractor's security or operations related to the support or performance of this Statement of Work (SOW), and thus require a level of protection from adversarial collection or exploitation not normally afforded to unclassified information.

b) Practice OPSEC and implement countermeasures to protect Cl and other sensitive unclassified information and activities, especially those activities or information which could compromise classified information or operations, or degrade the planning and execution of military operations performed or supported by the contractor in support of the mission.

Protection of Cl will include the adherence to and execution of countermeasures which the contractor initiates or provided by NAVSEA, for Cl on or related to the SOW.

c) Sensitive unclassified information is that information marked FOR OFFICIAL USE ONLY (or

FOUO), Controlled Unclassified Information (CUI), Privacy Act of 1974, COMPANY

PROPRIETARY, and also information as identified by NSWCCD Security SME, Program Manager, or Contracting Officer Representative (COR).

d) NAVSEA has identified the following as Cl (not exhaustive list; more can be added):

1) Known or probable vulnerabilities to any U.S. system and their direct support systems

2) Details of capabilities or limitations of any U.S. system that reveal or could reveal known or probable vulnerabilities of any U.S. system and their direct support systems

3) Details of Information about military operations, missions and exercises

4) Details of U.S. systems supporting combat operations (numbers of systems deployed, deployment timelines, locations, effectiveness, unique capabilities, etc.)

5) Operational characteristics for new or modified weapon systems (Probability of Kill (Pk), Countermeasures, Survivability, etc.)

6) Required performance characteristics of U.S. systems using leading edge or greater technology (new, modified or existing}

7) Telemetered or data-linked data or information from which operational characteristics can be inferred or derived

8) Test or evaluation Information pertaining to schedules of events during which Cl might be captured (advance greater than 3 days)

9) Details of NAVSEA unique Test or Evaluation capabilities (disclosure of unique capabilities}

10) Existence and/or details of Intrusions Into or attacks against DoD Networks or Information

Systems, including, but not limited to, tactics, techniques and procedures used, network vulnerabilities exploited, and data targeted for exploitation

11) Network User ID's and Passwords

12) Counter-lED capabilities and characteristics, including success or failure rates, damage assessments, advancements to existing or new capabilities

DD 254 OPSEC Attachment

Current as of August 2017

13) Vulnerabilities in Command processes, disclosure of which could allow someone to circumvent security, financial, personnel safety, or operations procedures

14) Force Protection specific capabilities or response protocols

(timelines/equipment/numbers of personnel/training received/etc.)

15) Command leadership and VIP agendas, reservations, plans/routes etc.

16) Detailed facility maps or Installation overhead photography (photo with annotation of

Command areas or greater resolution than commercially available)

17) Details of COOP, NAVSEA emergency evacuation or emergency procedures

18) Government personnel Information that would reveal force structure and readiness (such as recall rosters or deployment lists)

19) Compilations of information that directly disclose Command Cl

3. All Cl developed by the contractor and/or NAVSEA, in electronic or hardcopy form, must be protected by a minimum of the following countermeasures:

a) All emails containing Cl must be DoD Public Key Infrastructure (PKI) signed and PKI encrypted when sent

b) Cl may not be sent via unclassified fax

c) Cl may not be discussed via non-secure phones

d) Cl may not be provided to individuals that do not have a need to know it in order to complete their assigned duties

e) Cl may not be disposed of in recycle bins or trash containers

f) Cl may not be left unattended in uncontrolled areas

g) Cl in general should be treated with the same care as CUI/FOUO or Proprietary information

h) Cl must be destroyed in the same manner as CU1/FOUO

i) Cl must be destroyed at contract termination or returned to the government at the government's discretion

4. The contractor shall document items of Cl that are applicable to contractor operations involving information on or related to the SOW. Such determinations of Cl will be completed using the DoD

OPSEC 5-step process as described in DoD 5205.02M (App 1 to Encl 3).

5. Per DoD 5205.2M (Encl 6), OPSEC training must be included as part of the contractors ongoing security awareness program. NAVSEA's OPSEC Computer Based Training (CBT) can be accessed via https://securityawareness.usalearning.gov/opsec/index.htm.

6. The contractor will not disclose sensitive unclassified information pertaining to a classified contract to the public without prior review and approval by NSWCCD OPSEC Program Manager and NSWCCD PAO.

7. If contractor cannot resolve an issue concerning OPSEC they will contact the COR (who will consult with the NSWCCD OPSEC Program Manager).

8. All above requirements MUST be passed to all Sub-contractors.

https://securityawareness.usalearning.gov/opsec/index.htm