Attachment 9 - LTS_OPSEC Plan.pdf

Local Telecommunication Services (LTS)

Operation Security (OPSEC) Plan

This OPSEC Plan establishes a baseline security protocols for the Local Telecommunication Services (LTS) contractor supporting Space Base Delta (SBD) 1 and SBD 41. It identifies Critical Information (CI) the contractor will access, outlines observable indicators, and mandates specific countermeasures to prevent adversary exploitation of telecommunications infrastructure and operations.

1.0 Purpose and Scope

1.1 This plan ensures all contractor personnel fully comply with AFI 10-701 and the SBD 1 and SBD 41 OPSEC program. It applies to all contractor employees, sub-contractors, and technical representatives executing the LTS PWS. The objective is to deny adversaries access to CI and observable indicators related to SBD 1 and SBD 41 communications capabilities, vulnerabilities, and infrastructure.

2.0 Critical Information & Indicator Identification

The contractor will inherently require access to sensitive mission data to fulfill the PWS.

The following table identifies the specific SBD 1 and SDB 41 Critical Information the contractor will handle and the associated indicators their activities may generate.

Mission Area Contractor-Handled Critical Information

Potential Observable Indicators

Telecommunications Architecture

System schematics, network status, 911 emergency routing, and hardware degradation/shortfalls.

Routine and emergency maintenance dispatches;

presence of special repair teams at demarcation points.

Facility Operations Demarcation points, building numbers, and critical node locations.

Sustained contractor vehicle presence at specific, high-value buildings.

Personnel Details Customer Service Records (CSRs), user locations, organization titles, and contact numbers.

Aggregation of unclassified directories; mishandling of physical or digital CSR data.

Outage & Incident Response

Degradation of critical IT infrastructure; traffic analysis reports showing vulnerabilities.

Sudden surge in after-hours contractor activity; unencrypted communications regarding system failures.

3.0 Threat and Vulnerability Assessment

3.1 The Threat: Adversaries continuously monitor public and commercial activities to piece together intelligence regarding Department of War (DoW) installations. They exploit Open- Source Intelligence (OSINT), monitor public communication channels, and conduct physical surveillance.

3.2 The Vulnerability: The contractor acts as a bridge between the commercial sector and secure military operations. Unsecured communications, improper disposal of CSRs, predictable work patterns, and unauthorized public disclosure of contract details serve as significant vulnerabilities.

4.0 OPSEC Measures & Countermeasures

To mitigate the identified risks, the contractor shall implement the following countermeasures during the execution of the PWS:

OPSEC Domain Required Countermeasures

Information Security

(INFOSEC)

All documents detailing system architecture, CSRs, and 911 routing must be protected as Controlled Unclassified Information (CUI). Transmission of CI must occur via encrypted channels.

Physical Security Contractor personnel must strictly adhere to SBD 1 and or SBD 41 badging and escort procedures. Work at critical nodes must be scheduled discreetly, when possible, to minimize observable indicators.

Communications Security (COMSEC)

Personnel are prohibited from discussing network vulnerabilities, outages, or critical node locations on unencrypted commercial radios, social media, or in public venues.

Data Aggregation Protection

The contractor must ensure that aggregated data (e.g., base directories, consolidated fault reports) is stored on authorized, secure systems and properly destroyed when no longer required.

5.0 Training and Reporting Requirements

5.1 Initial and Annual Training

5.1.1 Per PWS Section 3.11, all contractor personnel that have access to PWS and appendixes must complete OPSEC awareness training within 30 days of contract start and annually thereafter. Training must specifically cover the SBD 1 and SDB 41 CIIL and the requirements of this plan.

5.1.2 Provided the contractor personnel initial and annual training dates to the Contracting Officer Representative (COR).

5.2 Incident Reporting

5.2.1 Any suspected OPSEC compromise—such as unauthorized disclosure of CSRs, loss of architectural diagrams, or suspected surveillance of contractor work crews—must be reported immediately to the COR and the SBD 1 and or SBD 41 OPSEC Program Manager.