B08 Attachment 0003 - Operations Security (OPSEC) Plan Sample.pdf

For the best experience, open this PDF portfolio in

Acrobat X or Adobe Reader X, or later.

Get Adobe Reader Now!

http://www.adobe.com/go/reader

1. AT Level I Training: (This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area): All contractor employees, to include subcontractor employees, requiring access to Army installations, facilities and controlled access areas shall complete AT Level I awareness training within 30 calendar days after contract start date or effective date of incorporation of this requirement into the contract, whichever is applicable. The contractor shall submit certificates of completion for each affected contractor employee and subcontractor employee, to the COR or to the contracting officer, if a COR is not assigned, within 30 calendar days after completion of training by all employees and subcontractor personnel. AT level I awareness training is available at the following website:

https://jkodirect.jten.mil/ for CAC holders (Course number “-US007”). Non-CAC-holders may go to: http://jko.jten.mil/ courses/atl1/launch.html.

Additional remarks/requirements:

2. AT Awareness Training for contractor personnel traveling overseas for both unofficial and official travel: (This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area):

US based contractor employees and associated subcontractor employees shall receive government provided area of responsibility (AOR) specific AT awareness training as directed by AR 525-13, or other COCOM specific requirements, as necessary. Specific AOR training content is directed by the combatant commander with the unit ATO being the local point of contact. US based contractor employees and associated subcontractor employees will update their PRO-File survey prior to their official or unofficial travel, in accordance with AR 525-28, Personnel Recovery. The PRO-File survey is available at the following link: https://prmsglobal.prms.af.mil/prmsconv/Login/Banner.

YES NO

Version1-MAY21

UNCLASSIFIEDUNCLASSIFIED

Requiring Activity:

Solicitation/Contract Number:

Section I. Contract Requirements Package Antiterrorism/OPSEC/Security/Cybersecurity Review

Purpose of section: To document the review of the requirements package Performance Work Statement (PWS), Statement of Objectives (SOO), Statement of Work (SOW), quality assurance surveillance plan (QASP) and any applicable source selection evaluation criteria for Antiterrorism (AT) and other related protection matters to include, but not limited to: AT, Operations Security (OPSEC), cyber security, physical security, law enforcement, intelligence, and foreign disclosure. Army policy requirement:

A signed AT/OPSEC cover sheet is required to be included with requirements package.

Mandatory review and signatures: The organizational Antiterrorism Officer (ATO), Security Manager (SM), OPSEC Officer, and Information System Security Manager/Officer (ISSM/ISSO) must review and sign each requirements package prior to submission to the supporting contracting activity, to include coordination with other staff review, as appropriate per Section I below. The ATO must be certified as Level II. The OPSEC Officer must be certified as a Level II OPSEC Officer. In addition to an AT and OPSEC Officer signature, signatures from an appointed Security Manager (or designee) and an appointed Information System Security Manager/ Officer (or designee) are required. If the requiring activity (RA) does not have any qualified reviewers, the first functional person in the chain of command will review the contract for each functional consideration. Changes to the security requirements after the functional reviews are completed will void the review and require a subsequent functional review again.

A. ANTITERRORISM

Contract Name:

Date:

UNCLASSIFIED

JOINT PROGRAM EXECUTIVE OFFICE ARMAMENTS & AMMUNITION

CONTRACT REVIEW COVER SHEET

3. iWATCH Training (This standard language is for contractor employees with an area of performance within an Army controlled installation, facility or area): The contractor and all associated subcontractors shall brief all employees on the local iWATCH program (training standards provided by the requiring activity ATO). This local developed training will be used to inform employees of the types of behavior to watch for and instruct employees to report suspicious activity to the COR. This training shall be completed within 30 calendar days of contract award and within 30 calendar days of new employees commencing performance with the results reported to the COR NLT 60 calendar days after contract award.

4. For contractors authorized to accompany the force: DFARS Clause 252.225-7040 (DFARS Clause 252-225-7995 for CENTCOM), DFARS Clause 252.225-7040 (DFARS Clause 252-225-7995 for CENTCOM), Contractor Personnel Authorized to Accompany US Armed Forces Deployed Outside the United States. The clause shall be used in solicitations and contracts that authorize contractor personnel to accompany US Armed Forces deployed outside the US in contingency operations;

humanitarian or peacekeeping operations; or other military operations or exercises, when designated by the combatant commander. The clause discusses the following AT/OPSEC related topics: required compliance with laws and regulations, pre-deployment requirements, required training (per combatant command guidance), and personnel data required.

Antiterrorism Review Signature: I am an ATO (Level II Certified) and have reviewed the requirements package and understand my responsibilities in accordance with Army Regulation 525-13, Antiterrorism.

ATO Signature:

5. For Contract Requiring Performance or Delivery in a Foreign Country: DFARS Clause 252.225-7043, Antiterrorism/ Force Protection for Defense Contractors Outside the US. The clause shall be used in solicitations and contracts that require performance or delivery in a foreign country. This clause applies to both contingencies and non-contingency support. The key AT requirement is for non-local national contractor personnel to comply with theater clearance requirements and allows the combatant commander to exercise oversight to ensure the contractor’s compliance with combatant commander and subordinate task force commander policies and directives.

6. Formal OPSEC Program (Required if the place of performance will be at contractor’s own facilities): The contractor shall have an identified certified Level II OPSEC coordinator per AR 530-1. The contractor shall develop an OPSEC Standard Operating Procedure (SOP)/Plan within 90 calendar days of contract award, to be reviewed and approved by the responsible Government OPSEC officer. This plan will include a process to identify critical information, where it is located, who is responsible for it, how to protect it and why it needs to be protected.

B. OPERATIONS SECURITY

7. For contracts that require OPSEC Training: Per AR 530-1 Operations Security, the contractor employees must complete Level I OPSEC Awareness training. New employees must be trained within 30 calendar days of their reporting for duty and annually thereafter. Level I OPSEC training is available at the following website:

http://cdse.edu/catalog/elearning/GS130.html (Duration: 45 minutes).

Operations Security Review Signature: I am OPSEC level II certified and have reviewed the requirements package, and it is in compliance with Army Regulation 530-1, Operations Security.

OPSEC Officer Signature:

9. For Cyber Awareness (Information assurance (IA)/information technology (IT)) training: All contractor employees and associated sub-contractor employees must complete the DoD IA awareness training before issuance of network access and annually thereafter. All contractor employees working IA/IT functions mustcomply with DoD and Army training requirements in DoDD 8570.01, DoD 8570.01-M and AR 25-2 within six months of appointment to IA/IT functions.

8. Army Training Certification Tracking System (ATCTS) Registration (Required when contractor employees require access to government information systems): All contractor employees with access to a government information system must be registered in the ATCTS (Army Training Certification Tracking System) at commencement of services, and must successfully complete the DoD Cybersecurity Awareness Challenge and Accepted Use Policy (AUP) prior to access to the IS, and then annually thereafter. IT access requests must include current AUP and training certificates for initial and contract renewals.

UNCLASSIFIEDUNCLASSIFIED

C. INFORMATION ASSURANCE/CYBERSECURITY

10. For Controlled Unclassified Information (CUI)/Controlled Technical Information (CTI)/DoD Critical Program Technology related to Information Systems: If applicable, choose from the below options and insert corresponding language into SOW/ PWS (If either option is checked "Yes", then Item 17 below must also be checked “Yes”).

10a. CUI pertaining to Information Systems/Networks: Contractor will need to receive, process, store and/or generate CUI on contractor-owned Information Systems and networks (DFARS Clause 252.204-7012 applies).

10b. CTI and/or DoD Critical Program Technology (Applicable standard language is outlined in ASA(ALT) Signed Memorandum Implementation of Enhanced Security Protections for Contractor Information Systems, 24Feb20): The language in the Signed Memo shall be included in the SOW/PWS that contain DFARS Clause 252.204-7012, when the contract or order: (1) Involves CTI, as described in references DoDI 5230.24 and DoDI 3200.12; or (2) Is identified in the DoD Critical Program and Technology list as directed by Section 1049 of the National Defense Authorization Act of Fiscal year 2019.

12. For contracts that require handling or access to Classified Information (If checked "yes", must complete Section II of this document): Contractor shall comply with FAR 52.204-2, Security Requirements. This clause involves access to information classified “Confidential,” “Secret,” or “Top Secret” and requires contractors to comply with— (1) The Security Agreement (DD Form 441), including the National Industrial Security Program Operating Manual (DoD 5220.22-M); (2) any revisions to DoD 5220.22-M, notice of which has been furnished to the contractor.

13. Threat Awareness Reporting Program (TARP) (For all contactors with security clearances): Per AR 381-12 Threat Awareness and Reporting Program (TARP), contractor employees must receive annual TARP training by a CI special agent or other trainer as specified in 2-4b.

14. For contractors requiring Common Access Cards (CAC): Before CAC issuance, the contractor employee requires, at a minimum, a favorably adjudicated Tier 1 (formerly known as the National Agency Check with Inquiries (NACI)) or an equivalent or higher investigation in accordance with Army Directive 2014-05. The contractor employee will be issued a CAC only if duties involve one of the following: (1) Both physical access to a DoD facility and access, via logon, to DoD networks on-site or remotely; (2) Remote access, via logon, to a DoD network using DoD-approved remote access procedures; or (3) Physical access to multiple DoD facilities or multiple non-DoD federally controlled facilities on behalf of the DoD on a recurring basis for a period of 6 months or more. At the discretion of the sponsoring activity, an interim CAC may be issued based on a favorable review of the FBI fingerprint check and a successfully scheduled Tier 1 at the Defense Counterintelligence and Security Agency (DCSA).

Information System Security Manager/Officer Review Signature: I have reviewed the requirements package and it contains the correct information to meet the cybersecurity requirements of this effort.

ISSM/ISSO Signature:

D. SECURITY

11. For Cyber (Information assurance (IA)/information technology (IT)) certification: Per DoD 8570.01-M, DFARS

252.239.7001 and AR 25-2, the contractor employees supporting IA/IT functions shall be appropriately certified upon contract award. The baseline certification as stipulated in DoD 8570.01-M must be completed upon contract award.

15. For contractors that do not require CAC, but require access to a DoD facility or installation: Contractor and all associated subcontractors employees shall comply with adjudication standards and procedures using the National Crime Information Center Interstate Identification Index (NCIC-III) and Terrorist Screening Database (TSDB)(Army Directive 2014-05/AR 190-13), applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided by government representative), or, at OCONUS locations, in accordance with status of forces agreements and other theater regulations.

Security Manager Signature:

16. Access and general protection/security policy and procedures (This standard language is for contractor employees with an area of performance within Army controlled installation, facility, or area): Contractor and all associated subcontractors employees shall provide all information required for background checks to meet installation access requirements to be accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. Contractor workforce must comply with all personal identity verification requirements (FAR clause 52.204-9, Personal Identity Verification of Contractor Personnel) as directed by DoD, HQDA and/or local policy. In addition to the changes otherwise authorized by the changes clause of this contract, should the Force Protection Condition (FPCON) at any individual facility or installation change, the Government may require changes in contractor security matters or processes.

Security Manager Review Signature: I have reviewed the requirements package and it contains the correct information to meet the security requirements for this effort.

18. For contracts that require access to Critical Program Information (CPI): (If yes, the requester must identify the applicable Program Protection Plan (PPP) required for all programs with CPI) All contractor employees, including subcontractor employees, shall comply with the applicable PPP. The contractor shall comply with DOD and DA technology protection requirements in DODI 5200.39, AR 70-1 and DA PAM 70-3.

17. Controlled Unclassified Information (CUI): Contractor employees that will require access to CUI will follow all DoD (DoDI 5200.48) and Army policies regarding access to CUI, and the handling, storage, transmission, and destruction of CUI.

Contractor employees are required to complete initial CUI training (available at https://securityhub.usalearning.gov/ index.html) within 30 days of start of performance on the contract, and then annually thereafter. All CUI must be transmitted via encrypted channels such as the DoD Safe Access File Exchange (SAFE) website (https://safe.apps.mil/).

2. Actual Performance Locations (If known , locations can be provided. Otherwise, must be updated upon contract award)

GOVERNMENT LOCATIONS

CONTRACTOR FACILITIES (THIS INFORMATION MUST BE UPDATED AT TIME OF CONTRACTOR SELECTION/CONTRACT AWARD)

NAME, ADDRESS, AND ZIP CODE CAGE CODE COGNIZANT SECURITY OFFICES (CSO)

(Name, Address, ZIP Code, Telephone)

Requiring Activity:

Solicitation:

Contract Number:

Section II. Performance Work Statement (PWS), Statement of Objectives (SOO), or Statement of Work (SOW) Security Requirements Appendix

NOTE: This section will only need to be completed if Item 12 (in Section I) was marked "Yes" indicating that the contractor will require access to classified information under the contract .

1. Security Requirements

In the performance of this contract, the contractor will require a ______________ Facility Clearance Level (FCL) with ______________ safeguarding authorization. The contractor must have the appropriate FCL at the time of award. If USG sponsorship for prime contractor FCL is required, the contractor will work with the Contracting Officer (KO) and/or Contracting Officer’s Representative (COR) to obtain the appropriate justification for FCL sponsorship. The Defense Counterintelligence and Security Agency (DCSA) manages the FCL determination process and it is the responsibility of the contractor to work with the DCSA to obtain the appropriate clearance. KO approval is required for the flow down of security requirements to any subcontractor for DD Form 254 items 10a, 10b, 10c, 10e(1), 10e(2), 10f, and 10g. KOs are the only authority able to approve the addition of subcontractors. Safeguarding is limited to those facilities which hold the appropriate DSCA-issued FCL. The level of safeguarding must be commensurate with the level listed in item 1b of the DD Form 254 associated with this effort. The contractor will be required to access classified material at the following locations:

3. Contractor will require access to (all items checked “YES” will apply to this effort and all items checked “NO” are not applicable to this effort and requirements will not be levied against the contractor):

YES NO YES NO

4. In performing this contract, the contractor will (all items checked “YES” will apply to this effort and all items checked “NO” are not applicable to this effort and requirements will not be levied against the contractor):

YES NO YES NO

Have access to classified information only at another contractor’s facility or a government activity

Receive and store classified documents only

Receive, store, and generate classified information or material

Fabricate, modify, or store classified hardware

Perform services only

Have access to U.S. classified information outside the U.S., Puerto Rico, U.S. Possessions and Trust Territories

Be Issued a Common Access Card (CAC)

Be authorized to use the services of Defense Technical Information Center (DTIC) or other secondary distribution center

Require a COMSEC account

Have a TEMPEST requirement

Have Operations Security (OPSEC) Requirements

Be authorized to use Defense Courier Service

Receive, store, or generate CUI

Other

Communications Security (COMSEC) Information

Restricted Data (information concerning the design, manufacture, or utilization of atomic weapons)

Critical Nuclear Weapon Design Information

(CNWDI)

Formerly Restricted Data

Sensitive Compartmented Information (SCI)/ Intelligence Information

Non-SCI/Intelligence Information

Special Access Program (SAP) Information

North Atlantic Treaty Organization (NATO) Information

Foreign Government Information (FGI)

Alternative Compensatory Control Measures (ACCM)

Controlled Unclassified Information (CUI)

Access to NIPRNet

Access to JWICS Location:

Access to SIPRNet Location:

TITLE DATE FUNCTIONAL OFFICE OF PRIMARY RESPONSIBILITY

Example: ARCYBER SCG FOR CYBERSPACE

OPERATIONS AND SECURITY

19 MAY 2016 U.S. ARMY CYBER COMMAND AND SECOND ARMY, or most current SCG.

7. The contractor will require access to the following Program Protection Plans:

TITLE DATE FUNCTIONAL OFFICE OF PRIMARY RESPONSIBILITY

8. Additional Remarks not already addressed in items 1 – 6 of this Security Appendix - Procedures for termination of contractor access or the reference of local and Army policy should be incorporated here.

Additional Remarks

5. The contractor will require access to the following Security Classification Guides (SCG):

6. Contract Description: Provide a brief statement that describes the purpose or scope of this contract or procurement.

Untitled

Untitled

Additional remarksrequirements:

Additional remarksrequirements_2:

Additional remarksrequirements_4:

Additional remarksrequirements_5:

Additional remarksrequirements_6:

Additional remarksrequirements_8:

Additional remarksrequirements_9: TDP is Distro D making this a requirement on the contract.

Additional remarksrequirements_10:

Additional remarksrequirements_11:

Additional remarksrequirements_12:

Additional remarksrequirements_13:

Additional remarksrequirements_14:

GOVERNMENT LOCATIONSRow1:

NAME ADDRESS AND ZIP CODERow1:

CAGE CODERow1:

COGNIZANT SECURITY OFFICES CSO Name Address ZIP Code TelephoneRow1:

1: Off

6: Off

7: Off

2: Off

8: Off

3: Off

4: Off

9: Off

5: Off

5b: Off

10: Off

12: Off

13: Off

15: Off

21: Off

16: Off

22: Off

17: Off

24: Off

18: Off

19: Off

25: Off

20: Off

26: Off

27: Off

28: Off

Textaa: PM CAS

Textab: TBD a: Choice1 b: Choice1 d: Choice1 f: Choice2 h: Choice1 i: Choice2 j: Choice1 l: Choice1 m: Choice1 n: Choice1 o: Choice1 p: Choice3

2022-05-25T09:24:33-0400

COSTELLO.BRAD.L.1269155210

2022-05-25T09:24:54-0400

COSTELLO.BRAD.L.1269155210

2022-07-28T10:31:03-0400

HAYMAN.JASON.J.1280617144

e: Choice1

Additional remarksrequirements_7:

2022-05-26T12:34:40-0400

VIMBA.HEATHER.TRUESDELL.1228861002

11: Off

Additional remarksrequirements_16:

Additional RemarksRow1:

c: Choice1

Text1:

Text2:

Text3:

Text4:

Text6:

Text7:

Text8:

Text9:

29: Off q: Choice3 r: Choice1 s: Choice3

Dropdown1:

2: [ ]

1: [ ]

SCG Title:

SCG Issue Date:

OPR Name:

Contract Description:

PPP Title:

g: Choice2

PPP Date:

PPP OPR Name:

OPSEC Remarks:

IA1: Choice1

Text5: Mortar Tail Fin Assembly

Date6_af_date: 5/5/22

CUI

TITLE OF PROGRAM

OPERATIONS SECURITY PLAN

Contract No. ______________

Date

Prepared by: (signature) Approved by: (signature)

Typed Name Typed Name Title (Pres/CEO/Head of Co., etc.)

Title

Prepared for: Submitted by:

Contracting Organization Contractor Address Address

Distribution Statement:

(WHEN COMPLETED need this notice) NOTICE: The enclosed information is considered sensitive critical information to the Joint Munitions Command (JMC) and should be distributed only to those with a valid need-to-know. Do not publicly disseminate sensitive information. Any further dissemination without authorization from JMC is prohibited. Personnel who fail to protect sensitive information from unauthorized disclosure may be subject to administrative, disciplinary, contractual, or criminal action.

TABLE OF CONTENTS

1. General 4

1.1 Administration

1.2 Applicability

1.3 Responsibilities

1.3.1 OPSEC Manager

1.3.2 Personnel

1.4 Purpose

1.5 Subcontractor Applicability

1.6 Controlled Unclassified Information (CUI)

1.6.1 Handling, Storing & Transmitting CUI

1.6.2 Markings

1.7 Distribution Requirements for Technical Documents

1.7.1 Distribution Statement Definition

1.7.2 Handling and Destroying Limited Distribution Documents

1.7.3 Export Control Warnings

2. Critical Information 7

3. Threats 8

3.1 General Applicability

3.2 Human Intelligence (HUMINT)

3.2.1 Overt – Open Source Intelligence (OSINT)

3.2.2 Visitors

3.2.3 Covert – Illegal Entry/Coercion/Collusion

3.3 Signals Intelligence (SIGINT)

3.4 Imagery Intelligence (IMINT)

3.5 Measurement & Signatures Intelligence (MASINT)

3.6 Intelligence Threats to (company)

3.6.1 Worldwide General Threat

3.6.2 Changing Nature of the Worldwide Threat

3.6.3 Intelligence Collection Threat to (company)

4. Vulnerabilities 11

4.1 General Vulnerabilities

4.2 Contractual Vulnerabilities

5. Assessment of Risk 12

6. OPSEC Measures 13

5.1 General OPSEC Measures

5.2 Contractual OPSEC Measures

7. Self-Assessment 14

ACRONYMS 15

REFERENCES 15

1. GENERAL

1.1 ADMINISTRATIVE

This Operations Security (OPSEC) Plan will serve as the implementing document for contract activities undertaken by (company name) on the (program name) program under (contract number). The specific objectives of this contractual effort are to (produce… what?). A copy of the plan will be available for each participant to review.

This plan will be reviewed periodically by the OPSEC Manager as additional intelligence threat information becomes available, or as the program plan changes, but no less than annually. Specific changes may be required periodically by the JMC, or as OPSEC considerations on this program occur.

1.2 APPLICABILITY

This plan is applicable to appropriate (product name) elements at all (company name) and subcontractor facilities and locations that may be tasked to work on the program.

Each subcontractor is responsible for OPSEC implementation. (Add additional information as necessary).

1.3 RESPONSIBILITIES

1.3.1 OPSEC MANAGER

The (company name) OPSEC Manager is responsible for developing the OPSEC Plan and monitoring its implementation and operation to ensure compliance. He serves as the principal advisor to the (company name) on all OPSEC matters and will:

1) Coordinate all OPSEC policy responsibilities and procedures within the program.

2) Revise the OPSEC Plan as necessary.

3) Coordinate the annual review and update of the sensitive aspects of the program.

4) Accumulate and disseminate updated threat information to program personnel.

5) Assist in the review of contract requirements for OPSEC considerations.

6) Conduct OPSEC Program briefing(s) after customer approval of the plan.

7) Ensure that all other facilities supporting the program develop similar procedures or comply with the requirements of this plan.

1.3.2 PERSONNEL

Employees associated with (program name) are required to attend all Program OPSEC briefings. Personnel must comply with all OPSEC principles and procedures. Program personnel should consider this OPSEC Plan as their plan to protect the U.S. technological lead and (company name)’s competitive position. How well each team member protects sensitive information on this project may not only affect our national security, but may directly impact (company name)’s future business endeavors.

1.4 PURPOSE

The five steps in the OPSEC process are:

1) Identification of Critical Information,

2) Analysis of threats,

3) Analysis of vulnerabilities,

4) Assessment of risk, and

5) Application of OPSEC measures.

This five step process is continuous and assessment should occur frequently throughout the operation. OPSEC is a mandated program designed to safeguard sensitive program information, operations and activities which if exploited could compromise current or future plans and activities. This is accomplished by the identification and elimination or control of vulnerabilities that might be exploited by intelligence analysis. This OPSEC plan is designed to document the OPSEC analysis and outline procedures to be followed by program employees to prevent the disclosure of classified information and/or minimize revelation of sensitive information, activities, and operations to any unauthorized person, thus purposefully impeding intelligence collection efforts. Applicable activities and operations of the contract will be analyzed to determine known or suspected vulnerabilities to this program. Countermeasures designed to eliminate or reduce these vulnerabilities to an acceptable risk level have been established and implementing instructions are identified in Section 6 of this plan.

1.5 SUBCONTRACTOR APPLICABILITY

OPSEC will apply to the activities of (subcontractor names). They must implement and operate within the approved (company name) OPSEC Plan. An OPSEC assessment of their activities must be conducted, documented and submitted to (company name) for approval. International subcontractors, as well as any additional U.S. subcontractors, will receive OPSEC guidance, as applicable. Determination as to whether OPSEC should be imposed is the responsibility of each subcontractor with respect to his or her lower tier suppliers in accordance with the guidance received from its prime contractor. For those subcontractors not conversant or experienced with the Operations Security Program, (company name) will provide additional guidance to aid in the development of their OPSEC Plan.

1.6 CONTROLLED UNCLASSIFIED INFORMATION (CUI)

(Company name) has been authorized to receive, generate, and protect CUI material as part of the Contract Requirements. This section outlines the requirements for safeguarding CUI. CUI includes topics of unclassified information that are eligible for exemption from mandatory public disclosure under the Freedom of Information Act (FOIA).

(Company name) is also authorized to protect as CUI, information that is:

1) Contained in commercial or financial information generated by or for the Government with the understanding it is on a privileged or confidential basis (e.g., bids, contracts, proposals, trade secrets, inventions, discoveries, proprietary data, or data on contract performance, income, profits, losses and expenditures, etc.).

2) Included in communications to Government agencies and Commands that offer advice, suggestions, or reports prepared on behalf of the Army; and received or generated by a Command preliminary to a decision or action where premature disclosure would interfere with the purpose for which the records are created.

1.6.1 HANDLING, STORING, AND TRANSMITTING CUI

Program personnel shall be briefed on CUI procedures. Access to CUI material will be limited to those personnel who need the material to do their job. CUI material shall be handled in a way to preclude its disclosure to the general public. During working hours, reasonable steps should be taken to minimize risk of access by unauthorized personnel.

After working hours, CUI information will be stored in locked desks, file cabinets, bookcases or similar items. CUI documents can be transmitted via first class mail, parcel post, or, for bulk shipments, fourth class mail. Electronic transmission of CUI information by voice, data, facsimile or similar means, should be by approved secure communications systems whenever possible. CUI documents will be disposed of by shredding or tearing into pieces and discarding the pieces in regular trash containers.

1.6.2 MARKINGS

All materials defined as CUI will be marked “Controlled Unclassified Information” in letters larger than the rest of the text near the bottom of each unclassified page containing CUI.

The abbreviation “CUI” will not be used. Program personnel will contact the OPSEC Manager to receive instruction on proper markings.

1. 7 DISTRIBUTION REQUIREMENTS FOR TECHNICAL DOCUMENTS

All technical documents, including such informal documents as working papers, memoranda, and preliminary reports if those documents are not already in the public domain, and if they are likely to be disseminated outside of the Department of Defense shall be marked with the appropriate distribution statement. Technical information is defined by DoD Instruction 5230.24 as: information, including scientific information, that relates to research, development, engineering, test, evaluation, production, operation, use, and maintenance of munitions and other military supplies and equipment. Distribution marking requirements apply to technical information generated in any form.

1.7.1 DISTRIBUTION STATEMENT DEFINITION

A statement used in marking a technical document to denote the extent of its availability for distribution, release, and disclosure without additional approvals or authorizations. A distribution statement marking is distinct from, and in addition to, a security classification marking assigned in accordance with DoD Instruction (DoDI) 5200.01 (Reference (b)), is to reissue DoD 5200.1-R Information Security Program, January 14, 1997 as a DoD Manual to implement policy, assign responsibilities, and provide procedures for the designation, marking, protection, and dissemination of controlled unclassified information (CUI) and classified information, including information categorized as collateral, sensitive compartmented information (SCI), and Special Access Program (SAP).

Distribution statements and notices authorized for use on DoD technical documents to limit their distribution as well as the reasons and definitions for such markings can be found in DoD Instruction 5230.24, Distribution Statements on Technical Documents, August 23, 2012.

1) DISTRIBUTION A – Approved for public release. Distribution is unlimited.”

2) DISTRIBUTION B – Distribution authorized to U.S. Government agencies only (fill in reason) (date of determination or this document shall be referred to (insert controlling DoD office).”

3) DISTRIBUTION C – Distribution authorized to U.S. Government agencies and their contractors (fill in reason) (date of determination). Other request for this document shall be referred to (insert controlling DoD office).”

4) DISTRIBUTION D – Distribution authorized to the Department of Defense and U.S.

DoD contractors only (fill in reason) (date of determination). Other requests shall be referred to (insert controlling DoD office).”

5) DISTRIBUTION E – Distribution authorized to DoD Components only (fill in reason) (date of determination). Other requests shall be referred to (insert controlling DoD office).”

6) DISTRIBUTION F – Further dissemination only as directed by (inserting controlling DoD office) (date of determination) or higher DoD authority.” Distribution Statement F may be applied under rare and exceptional circumstances when specific authority exists or when need-to-know must be verified.

7) DISTRIBUTION X – Distribution Statement “X” is superseded by issuance of this Instruction. Subsequent dissemination of formerly Distribution Statement X documents shall display Distribution Statement C, with export control as the reason and shall be marked as directed in paragraph 8.a of Enclosure 3, unless changed by the controlling DoD office.

1.7.2 HANDLING AND DESTROYING LIMITED DISTRIBUTION DOCUMENTS

Limited Distribution documents shall be handled using the same standard as “Controlled Unclassified Information (CUI)” material, and will be destroyed by any method that will prevent disclosure of contents or reconstruction of the document. When local circumstances or experience indicates that this destruction method is not sufficiently protective of unclassified limited information, local authorities may prescribe other methods but must give due consideration to the additional expense balanced against the degree of sensitivity.

1.7.3 EXPORT CONTROL WARNING

All technical documents that are determined to contain export-controlled technical data shall be marked “WARNING – This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751, et seq.) or the Export Administration Act of 1979, as amended, Title 50, U.S.C., App. 2401, et seq. Violations of these export laws are subject to severe criminal penalties. Disseminate in accordance with provisions of DoD Directive 5230.25.”

2. CRITICAL INFORMATION (CI)

The definition of critical information refers to all information, operations, and activities to be undertaken in performance of the contract that might reveal information necessary to the success of the program. OPSEC cannot protect everything, so the most important items should be afforded the greatest protection. The following pieces of critical information are those items of the (program name) program that have vulnerabilities identified.

Amendments to this OPSEC Plan and CI list will be made as additional CI are identified.

(Use the CI provided by the Contracting Officer. If you feel others are appropriate, add them, but keep list to 10 items or less. Think about your capabilities, activities, limitations (vulnerabilities), and intentions that if the adversary finds out about them, he could stop or severely hinder your production efforts.)

1) 2) 3) 4) 5) 6) 7) 8) 9) 10)

3. THREATS

3.1 GENERAL APPLICABILITY

Based upon information provided by JMC and other Government Agencies, the threats applicable to the (program name) efforts stem primarily from five sources: Human Intelligence (HUMINT), Signals Intelligence (SIGINT), Imagery Intelligence (IMINT), Measurement and Signatures Intelligence (MASINT) and Open Source Intelligence (OSINT). The worldwide intelligence collection threat is multi-disciplined, highly sophisticated, and extremely dedicated. Intelligence collection efforts may use only one discipline (or a combination of disciplines) to obtain information. As new threat data is received, distribution shall be made to program personnel and other participants in program activities as appropriate.

3.2 HUMAN INTELLIGENCE (HUMINT) THREAT

Human intelligence describes activities to obtain both classified and unclassified information through the use of human agents. Endeavors of human agents (both overt and covert) pose a substantial threat if countermeasures to neutralize or minimize their activities are not employed.

3.2.1 OVERT – OPEN SOURCE INTELLIGENCE (OSINT) THREAT

Significant quantities of unclassified, highly technical documents (both formal as well as in-house distribution and coordination items) offer a lucrative target to an adversary.

Requests for documents relating to the program should be anticipated since many Intelligence Services work through clearinghouses and employ cover organizations in their increasing attempts to collect technology. Literature Intelligence (LITINT) is a category of intelligence information derived from written/printed/graphic and computer database sources. It is information obtained from an analysis of information available to the general public and most often accomplished by overt HUMINT sources. With the development of computers, LITINT has assumed a greater role in worldwide information gathering. Vast amounts of information of significant interest to other governments are available in computerized databases. Computer aided LITINT is a key part of intelligence efforts that are accomplished with minimal risk and cost.

3.2.2 VISITORS

Visitors to the facilities include, but are not limited to government personnel, subcontractors, vendors, suppliers, contract labor organizations and service groups (repairmen, telephone, janitorial, etc.) who may obtain information of interest to an Intelligence Service. The greater danger to the program is the possible visual and aural disclosure of information that could inadvertently occur during these visits.

3.2.3 COVERT – ILLEGAL ENTRY/COERCION/COLLUSION (ESPIONAGE)

While this aspect of HUMINT is normally considered to be the exception rather than the rule, the possibility still exists for these methods to be employed against the program. With joint ventures and international partners the probability is almost assured. Examples include placing serendipitous listening devices in meeting rooms and foreign aircraft carriers, recruiting agents from the general population and key people who have access to sensitive information, etc. This type of intelligence gathering includes all clandestine and illegal activities and operations of Intelligence Services. Covert operations inflict severe damage and compromise to our country. These items are included as an awareness factor to ensure program participants are fully cognizant of the possible threats from various Intelligence Services.

3.3 SIGNALS INTELLIGENCE (SIGINT) THREAT

SIGINT describes the capability to obtain classified and certain unclassified information by monitoring communication systems, or by analyzing electromagnetic radiation/emanations from various types of equipment. Most activities and organizations are highly susceptible to the SIGINT threat. SIGINT is derived from signal interception and includes all Communications Intelligence (COMINT), Electronics Intelligence (ELINT) and Foreign Instrumentation Signals Intelligence (FISINT). Telephone conversations are especially vulnerable because most are relayed, at some point in transmission, via microwave signals that are easily monitored. The use of double-talk and self-generated codes is not effective as a means to protect sensitive information during telephone conversations. Professional intelligence analysts easily defeat these procedures.

3.4 IMAGERY INTELLIGENCE (IMINT) THREAT

IMINT describes the capability to derive information from imagery developed over the full range of the electromagnetic spectrum. Intelligence Service representatives see a distinct danger in the employment of clandestine photography. Applications of IMINT include:

Hand-held photography; satellites, scheduled commercial aircraft and private aircraft overflights that employ advanced photographic techniques; and unauthorized use of copying/duplicating equipment. IMINT frequently provides very valuable intelligence.

Imagery of experiments or tests can be obtained from land, sea, air and space platforms.

The most serious threat from IMINT resources at the national level stems from photoreconnaissance satellites.

3.5 MEASUREMENT AND SIGNATURES INTELLIGENCE (MASINT) THREAT

MASINT is technically derived intelligence that detects, locates, tracks, identifies, and describes the unique characteristics of fixed and dynamic target sources. MASINT contributes both unique and complementary information on a wide range of intelligence requirements, and is often the basis for cross-cueing other collection disciplines. It is considered highly reliable since it collects performance data and characteristics on actual targets that do not intend to create an indication of presence or activity. MASINT target signatures are converted into threat recognition and identification profiles and the surveillance, tracking, discrimination, and engagement algorithms that guide smart weapons. Civil applications can include timely warning of forest fires and volcanic eruptions, tracking volcanic ash clouds, detecting pollution sources, and providing data on natural phenomena to support environmental studies.

3.6 INTELLIGENCE COLLECTION THREATS TO (COMPANY)

The following analysis of threat is from unclassified sources. There is a consensus within the U.S. Intelligence Community that such collection efforts face almost all contractors developing and producing technologies. Any business enterprise operating in the global competitive market should recognize that it is continually targeted by intelligence collection efforts.

3.6.1 WORLDWIDE GENERAL THREAT

Pervasive worldwide multi-discipline information collection activities are being conducted against U.S. contractors on a daily basis. Increasingly significant resources are devoted to monitoring activities of U.S. Defense contractors. Clearly, our adversaries can produce reliable information on business capabilities, vulnerabilities, and intentions. The intelligence threat to the U.S. economic and scientific base has actually increased dramatically since the end of the cold war.

3.6.2 CHANGING NATURE OF THE WORLDWIDE THREAT

The collapse of the Soviet Union (now the Commonwealth of Independent States – (CIS)) in December 1991 intensified the intelligence collection threat posed by foreign countries.

That collapse allowed the redirection of collection efforts from the military to technological and economic interests. Our traditional adversaries continue to conduct intelligence activities. Over 50 Third World governments, using intelligence training received from former Soviet Union bloc countries, continue to act unilaterally in intelligence collection.

Nontraditional adversaries, 94 out of 171 countries studied, target the U.S. Over 20 nations (both friends and foes) have been identified as conducting economic espionage activities against U.S. Corporations. They target any information that will give their indigenous companies an edge in the world marketplace. This economic espionage is expected to continuously increase in the near future with the main target being the theft of “core” technologies. To a lesser degree countries in Asia, Europe, the Middle East and Latin America are also collecting. The most active countries are the CIS, Israel, France, and Japan. The most proficient are China, Japan, France, Israel, Sweden, Switzerland and Britain. Foreign Countries use this type of intelligence to directly support business - -their spying easily pays for itself. They target not only western technology to help their country’s industry compete in the world marketplace, but also seek to obtain financial and commercial information to gain an immediate bottom-line advantage in the world marketplace.

3.6.3 INTELLIGENCE COLLECTION THREAT TO (COMPANY NAME)

The threat to operations of the U.S. or individual companies arises from the capabilities of hostile countries, friendly countries, or competitors, to piece together bits of information.

Information is analyzed over time to determine patterns and to assign meanings to detectable activities. Generally, competitive analyses and estimates are very valuable if they are 70% correct. At 100% correct, these predictions are invaluable to our competitors or adversaries.

(Fill in the threat information provided by the Contracting Officer.)

4. VULNERABILITIES

Vulnerabilities of the program may reveal sensitive or classified information, operations, plans and/or activities, and are derived by comparing the threat to the sensitive aspects of the contract and assessing the OPSEC Indicators.

4.1 GENERAL VULNERABILITIES

The following vulnerabilities are most commonly identified in an OPSEC assessment.

1) Lack of OPSEC Awareness - Personnel do not fully realize their OPSEC responsibilities. Employees are not aware of the extent to which an adversary depends on obtaining unclassified information on a defense project and their capability to decipher important intelligence data from this seemingly non-critical information.

2) Testing - subsystem testing may be vulnerable to exploitation.

3) Open Source Literature - Even unclassified information released to the news media, or at meetings, seminars, and through contractor advertisements, may provide analytical centers with valuable information regarding individual systems capabilities, limitations and technical operations.

4) Professional Conferences/Symposia - Program personnel are susceptible to elicitation and exploitation when attending these events by fellow participants who covertly represent the intelligence collection agencies of foreign governments. Collection efforts may range from innocuous questions from foreign scientists to actual blackmail by intelligence agents. Without constant awareness of the threat, project personnel may inadvertently release information of analytic value.

5) Communications - All unsecured telephone conversations (including cellular phones) are vulnerable to monitoring, and all long distance microwave transmissions are subject to intercept. Such vulnerabilities provide a source of information for intelligence agents. Communications supporting computer systems and faxes are equally vulnerable.

6) Subcontracting - The prime contractor may fail to recognize the need for the imposition of OPSEC on its subcontractors.

7) Automated Information Systems (AIS) Operations - Without adequate security measures, AIS are susceptible to intrusion or tampering through both hardware and software manipulation. Further, the emanations from AIS equipment and power lines may be subject to intercept.

8) Visitor Control - Visitors within the facility may observe or hear sensitive information, operations, or activities.

9) Conference Room Security - Classified and sensitive information could be compromised by covert listening devices installed in meeting rooms frequently used for sensitive discussions.

10) Disgruntled Employees and Employees with Personal Problems (Adverse Information) - Personnel possessing security clearances who, through personal adversities or circumstances such as marital difficulties, criminal behavior, excessive indebtedness, and/or indiscriminate use of alcohol, present attractive targets to Intelligence Services.

Supervisors and/or fellow employees may become aware of these difficulties but may fail to notify management or security to investigate, electing to ignore the problem or rationalizing that some other party will take action. Non-action on the part of personnel who become aware of these situations can be as significant as that presented by an adversary who may attempt to exploit personnel experiencing these problems.

4.2 CONTRACTUAL VULNERABILITIES

In addition to the vulnerabilities identified above, these vulnerabilities are specific to (program name). (INSERT VULNERABILITIES IDENTIFIED FOR THIS PROGRAM.

CONSIDER THESE POSSIBLE SOURCES OF VULNERABILITY)

1) Use of a commercial travel office, travel patterns, and travel practices.

2) Geographic separation of the program participants.

3) Limitations of export license(s).

4) Effectiveness of the product.

5) Sympathies of program personnel for adversary countries.

6) Outdoor testing which results in exposure of the program to overhead (imagery) threats, HUMINT observation, etc.

7) Communications between test sites and program offices following testing.

8) Lack of procedures or failure to comply with those developed for controlling visits and documents/information release to international partners and subcontractors.

9) Unauthorized access to specific unclassified performance parameters related or identified with the program.

5. ASSESSMENT OF RISK

The purpose of this step is to select which of the tentative OPSEC measures to implement based on the threat and vulnerabilities identified. The Contractor must balance the risk of operational failure against the cost of OPSEC measures. Consider the following questions for each tentative measure.

1) What is the likely impact of an OPSEC measure on operational effectiveness if implemented?

2) What is the probable risk to mission success if the Company does not implement an OPSEC measure?

3) What is the probable risk to mission success if an OPSEC measure does not work?

4) What is the impact on future missions if this measure is adopted and successful?

6. OPSEC MEASURES

Analysis of vulnerabilities identifies OPSEC measures required to protect sensitive information under the (company name)’s control. The most desirable OPSEC measure combines the highest protection with the least impact on the (program name) effectiveness.

6.1 GENERAL OPSEC MEASURES

1) Education - (Company name) will use education and training to eliminate vulnerabilities discovered through ongoing OPSEC analysis. Participants (including new hires, consultants, transferees, contract labor personnel and subcontractors) shall be briefed and kept informed (through bulletins and/or revised OPSEC guidance) of all sensitive aspects of the Program and the measures designed for the protection of this information and the need for continued awareness and enforcement of OPSEC principles.

Program participants will be briefed concerning the OPSEC significance of their day-to-day…