Attachment 2a_PEO C4I OPSEC.pdf

OPERATIONS SECURITY (OPSEC) REQUIREMENTS

All work is to be performed in accordance with DoD and Navy OPSEC requirements, per the following applicable documents:

• National Security Decision Directive 298, National Operations Security Program (NSDD) 298

• DOD 5205.02, DOD Operations Security (OPSEC) Program Manual

• SECNAVINST 3070.2, Operations Security

• OPNAVINST 3432.1, Operations Security

• NAVWAR M-5510.1A, Chapter 11, Operations Security

The contractor will accomplish the following minimum requirements in support of the Naval Information Warfare Systems Command (NAVWARSYSCOM) OPSEC Program:

• The Contractor will practice OPSEC and implement OPSEC countermeasures to protect DoD Critical Information. Items of Critical Information are those facts, which individually or in the aggregate, reveal sensitive details about NAVWARSYSCOM or the contractor’s security or operations related to the support or performance of the contract SOO/SOW/PWS, and thus require a level of protection from adversarial collection or exploitation not normally afforded to unclassified information.

• Contractor must protect Critical Information and other sensitive unclassified information and activities, especially those activities or information which could compromise classified information or operations, or degrade the planning and execution of military operations performed or supported by the contractor in support of the mission.

• Protection of Critical Information will include the adherence to and execution of countermeasures which the contractor is notified by or provided by NAVWARSYSCOM, for Critical Information on or related to the SOO/SOW/PWS. Sensitive unclassified information is that information marked “CONTROLLED UNCLASSIFIED INFORMATION” or “CUI”,” Privacy Act of 1974”, “Company Proprietary”, and information identified by NAVWARSYSCOM.

NAVWARSYSCOM has identified the following items as Critical Information that may be related to this

SOO/SOW/PWS:

• Known or probable vulnerabilities to any U.S. system, and their direct support systems.

• Details of capabilities or limitations of any U.S. system that reveal or could reveal known or probable vulnerabilities of any U.S. system, and their direct support systems.

• Details of information about military operations, missions, and exercises.

• Details of U.S. systems supporting combat operations (numbers of systems deployed, deployment timelines, locations, effectiveness, unique capabilities, etc.).

• Operational characteristics for new or modified weapon systems (Probability of Kill, Countermeasures, Survivability, etc.).

• Required performance characteristics of U.S. systems using leading edge or greater technology (new, modified, or existing).

• Telemetered or data-linked data or information from which operational characteristics can be inferred or derived.

• Test or evaluation information pertaining to schedules of events during which Critical Information might be captured. (advance greater than 3 days).

• Details of Team NAVWAR unique Test or Evaluation capabilities (disclosure of unique capabilities).

• Existence and/or details of intrusions into or attacks against DoD Networks or Information Systems, including, but not limited to, tactics, techniques and procedures used, network vulnerabilities exploited, and data targeted for exploitation.

• Network User ID’s and Passwords.

• Counter-IED (Improvised Explosive Device) capabilities and characteristics, including success or failure rates, damage assessments, advancements to existing or new capabilities.

• Vulnerabilities in Command processes, disclosure of which could allow someone to circumvent security, financial, personnel safety, or operations procedures.

• Force Protection specific capabilities or response protocols (timelines/equipment/numbers of personnel/training received/etc).

• Command leadership and VIP agendas, reservations, plans/routes etc.

• Detailed facility maps or installation overhead photography (photo with annotation of Command areas or greater resolution than commercially available).

• Details of COOP, Team NAVWAR emergency evacuation procedures, or emergency recall procedures.

• Government personnel information that would reveal force structure and readiness (such as recall rosters or deployment lists).

Compilations of information that directly disclose Command Critical Information.

The above Critical Information and any that the Contractor develops, regardless if in electronic or hardcopy form, must be protected by a minimum of the following countermeasures:

• All emails containing Critical Information must be DoD Public Key Infrastructure (PKI) signed and PKI encrypted when sent.

• Critical Information may not be sent via unclassified fax.

• Critical Information may not be discussed via non-secure phones.

• Critical Information may not be provided to individuals that do not have a need to know it in order to complete their assigned duties.

• Critical Information may not be disposed of in recycle bins or trash containers.

• Critical Information may not be left unattended in uncontrolled areas.

• Critical Information in general should be treated with the same care as CUI or proprietary information.

• Critical Information must be destroyed in the same manner as CUI.

• Critical Information must be destroyed at contract termination or returned to the government at the government’s discretion.

The contractor shall document items of Critical Information that are applicable to contractor operations involving information on or related to the SOO/SOW/PWS. Such determinations of Critical Information will be completed using the DoD OPSEC 5 step process as described in National Security Decision Directive (NSDD) 298, “National Operations Security Program”.

OPSEC training must be included as part of the Contractor’s ongoing security awareness program conducted in accordance with Chapter 3, Section 1, of the NISPOM. NSDD 298, DoD 5205.02, “DOD Operations Security

(OPSEC) Program”, and OPNAVINST 3432.1, “Operations Security” should be used to assist in creation or management of training curriculum.

If the Contractor cannot resolve an issue concerning OPSEC, they will contact the PEO C4I COR to resolve.

The COR will consult with NAVWARSYSCOM HQ OPSEC and/or Security office(s) as needed.

All above requirements MUST be passed to all Sub-contractors.

Direct questions pertaining to the NAVWAR OPSEC Program to: Doug Turner, 619-524

7826, e-mail doug.w.turner@navy.mil.

mailto:doug.w.turner@navy.mil