N66604-18-Q-2954_Attachment_1_DD_254.pdf

CLASSIFICATION (When filled in): Unclassified

PREVIOUS EDITION IS OBSOLETE. Page 1 of 5

AEM LiveCycle Designer DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE. Page 1 of 5

AEM LiveCycle Designer

DD FORM 254, APR 2018

DEPARTMENT OF DEFENSE

CONTRACT SECURITY CLASSIFICATION SPECIFICATION

(The requirements of the National Industrial Security Program (NISP) apply to all security aspects of this effort involving classified information.)

OMB No. 0704-0567 OMB approval expires:

October 31, 2020

The public reporting burden for this collection of information, 0704-0567, is estimated to average 70 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to the Department of Defense, Washington Headquarters Services, at whs.mc-alex.esd.mbx.dd-dod-information-collections@mail.mil. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number.

RETURN COMPLETED FORM AS DIRECTED IN THE INSTRUCTIONS.

1. CLEARANCE AND SAFEGUARDING

a. LEVEL OF FACILITY SECURITY CLEARANCE (FCL) REQUIRED

(See Instructions)

Secret

b. LEVEL OF SAFEGUARDING FOR CLASSIFIED INFORMATION/

MATERIAL REQUIRED AT CONTRACTOR FACILITY

Secret

2. THIS SPECIFICATION IS FOR: (X and complete as applicable.)

a. PRIME CONTRACT NUMBER (See instructions.)

b. SUBCONTRACT NUMBER

c. SOLICITATION OR OTHER NUMBER

1300720667

DUE DATE (YYYYMMDD)

3. THIS SPECIFICATION IS: (X and complete as applicable.)

a. ORIGINAL (Complete date in all cases.)

DATE (YYYYMMDD)

20180827

b. REVISED (Supersedes all previous specifications.)

REVISION NO. DATE (YYYYMMDD)

c. FINAL (Complete Item 5 in all cases.) DATE (YYYYMMDD)

4. IS THIS A FOLLOW-ON CONTRACT? No Yes If yes, complete the following:

Classified material received or generated under (Preceding Contract Number) is transferred to this follow-on contract.

5. IS THIS A FINAL DD FORM 254? No Yes If yes, complete the following:

In response to the contractor's request dated , retention of the classified material is authorized for the period of:

6. CONTRACTOR (Include Commercial and Government Entity (CAGE) Code)

a. NAME, ADDRESS, AND ZIP CODE This DD254 is for solicitation purposes only

b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

7. SUBCONTRACTOR(S) (Click button if you choose to add or list the subcontractors -- but will still require a separate DD Form 254 issued by a prime contractor to each subcontractor) Add Row Remove last Row Delete All Rows

a. NAME, ADDRESS, AND ZIP CODE b. CAGE CODE c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

8. ACTUAL PERFORMANCE (Click button to add more locations.) Add Row Remove last Row Delete All Rows

a. LOCATION(S) (For actual performance, see instructions.) b. CAGE CODE (If applicable, see Instructions.)

c. COGNIZANT SECURITY OFFICE(S) (CSO) (Name, Address, ZIP Code, Telephone required; Email Address optional)

9. GENERAL UNCLASSIFIED DESCRIPTION OF THIS PROCUREMENT

THE CONTRACTOR SHALL PROVIDE ENGINEERING AND INTEGRATED LOGISTICS SUPPORT FOR IN-SERVICE US AND FOREIGN NAVY SURFACE VESSEL TORPEDO TUBE LAUNCHERS AND RELATED SUPPORT EQUIPMENT.

PREVIOUS EDITION IS OBSOLETE. Page 2 of 5

AEM LiveCycle Designer DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE. Page 2 of 5

AEM LiveCycle Designer

DD FORM 254, APR 2018

10. CONTRACTOR WILL REQUIRE ACCESS TO: (X all that apply. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. COMMUNICATIONS SECURITY (COMSEC) INFORMATION f. SPECIAL ACCESS PROGRAM (SAP) INFORMATION

b. RESTRICTED DATA g. NORTH ATLANTIC TREATY ORGANIZATION

(NATO) INFORMATION

c. CRITICAL NUCLEAR WEAPON DESIGN INFORMATION (CNWDI) (If CNWDI applies, RESTRICTED DATA must also be marked.) h. FOREIGN GOVERMENT INFORMATION

d. FORMERLY RESTRICTED DATA i. ALTERNATIVE COMPENSATORY CONTROL MEASURES

(ACCM) INFORMATION

e. NATIONAL INTELLIGENCE INFORMATION:

(1) Sensitive Compartmented Information (SCI)

(2) Non-SCI

j. CONTROLLED UNCLASSIFIED INFORMATION (CUI) (See instructions.)

k. OTHER (Specify) (See instructions.)

11. IN PERFORMING THIS CONTRACT, THE CONTRACTOR WILL: (X all that apply. See instructions. Provide details in Blocks 13 or 14 as set forth in the instructions.)

a. HAVE ACCESS TO CLASSIFIED INFORMATION ONLY AT

ANOTHER CONTRACTOR'S FACILITY OR A GOVERNMENT

ACTIVITY

(Applicable only if there is no access or storage required at contractor facility.

See instructions.)

b. RECEIVE AND STORE CLASSIFIED DOCUMENTS ONLY

c. RECEIVE, STORE, AND GENERATE CLASSIFIED

INFORMATION OR MATERIAL

d. FABRICATE, MODIFY, OR STORE CLASSIFIED HARDWARE

e. PERFORM SERVICES ONLY

f. HAVE ACCESS TO U.S. CLASSIFIED INFORMATION OUTSIDE

THE U.S.,PUERTO RICO, U.S. POSSESSIONS AND TRUST

TERRITORIES

g. BE AUTHORIZED TO USE THE SERVICES OF DEFENSE

TECHNICAL INFORMATION CENTER (DTIC) OR OTHER

SECONDARY DISTRIBUTION CENTER

h. REQUIRE A COMSEC ACCOUNT

i. HAVE A TEMPEST REQUIREMENT

j. HAVE OPERATIONS SECURITY (OPSEC) REQUIREMENTS

k. BE AUTHORIZED TO USE DEFENSE COURIER SERVICE

l. RECEIVE, STORE, OR GENERATE CONTROLLED UNCLASSIFIED

INFORMATION (CUI).

(DoD Components: refer to DoDM 5200.01, Volume 4 only for specific CUI protection requirements. Non-DoD Components: see instructions.)

m. OTHER (Specify) (See instructions.)

12. PUBLIC RELEASE

Any information (classified or unclassified) pertaining to this contract shall not be released for public dissemination except as provided by the National Industrial Security Program Operating Manual (NISPOM) or unless it has been approved for public release by appropriate U.S. Government authority.

Proposed public releases shall be submitted for review and approval prior to release to the appropriate government approval authority identified here with at least office and phone contact information and if available, an e-mail address. (See instructions)

DIRECT THROUGH (Specify below)

Commander, Naval Undersea Warfare Center, Division Newpor

Public Release Authority:

13. SECURITY GUIDANCE Add Signature Remove last Signature Delete All Signatures

The security classification guidance for classified information needed for this effort is identified below. If any difficulty is encountered in applying this guidance or if any other contributing factor indicates a need for changes in this guidance, the contractor is authorized and encouraged to provide recommended changes; to challenge the guidance or the classification assigned to any information or material furnished or generated under this contract;

and to submit any questions for interpretation of this guidance to the official identified below. Pending final decision, the information involved shall be handled and protected at the highest level of classification assigned or recommended.

(Fill in as appropriate for the classified effort. Attach, or forward under separate correspondence, any documents/guides/extracts referenced herein. The field will expand as text is added. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted. Also allows for up to 6 internal reviewers to digitally sign. See instructions for additional guidance or use of the fillable PDF.)

Block 10g: NATO INFORMATION -Item 10(g): Access up to NATO SECRET is authorized for this contract. Protection of NATO information shall be in accordance with USAAN 01-07 and its applicable enclosures. Access to NATO requires a final U.S. Government National Security Clearance and must have a NATO security briefing from the Facility Security Officer (FSO). The prime contractor must receive approval from the individual identified in Item 17(a) of this DD254 to impose NATO requirements or grant NATO access to a sub-contractor. Requests shall be submitted in writing.

Block 10J: CONTROLLED UNCLASSIFIED INFORMATION (CUI) -Item 10(j): DoD M-5200.01 Volume 4, DoD Information Security Program: Controlled Unclassified Information (CUI) of 2/24/2012

Block 11C: RECEIVE, STORE, AND GENERATE CLASSIFIED INFORMATION OR MATERIAL -Item 11 (c): The contractor requires access to classified source data up to and including the level identified in item 1a of this DD254.

Classified material generated in support of this contract shall be classified in accordance with the source material of the Navy Security

PREVIOUS EDITION IS OBSOLETE. Page 3 of 5

AEM LiveCycle Designer DD FORM 254, APR 2018 PREVIOUS EDITION IS OBSOLETE. Page 3 of 5

AEM LiveCycle Designer

DD FORM 254, APR 2018

Classification Guidance, which will be provided by the GCA. Automated Information Systems (AIS) must be certified and accredited by the Cognizant Security Agency (CSA) prior to processing classified information from NAVSEA.

Block 11J: OPSEC REQUIREMENTS “OPNAVINST 3432.1A, Operations Security of 4 Aug 2011”

Block 13:

This DD254 is for solicitation purposes only; therefore, it must be returned to (Appropriate Industrial Security Office) to be updated before the contract DD254 can be issued to the contractor.

“Classified or unclassified technical papers to be presented at a classified symposium must be approved by the NAVSEAHQ Contracting Officer's Representative (COR) prior to the presentation.”

“Contractor must submit a request for sharing of classified and other sensitive information between prime contracts in writing to the NUWCDIVNPT ISS identified in Block 16 of this form.”

“Personnel designated as derivative classifiers shall receive derivative classification training prior to access from the contractor's Facility Security Officer (FSO). The FSO shall ensure personnel receive initial and biennial training during the life of this contract. Evidence of completion, training certificates or equivalent, shall be provided to the Information Assurance Manager no later than the individual's due date.”

“All classified documents must be destroyed using a National Security Agency (NSA) approved high security crosscut shredder listed on the NSA/CSS evaluated products list(EPL) for high security crosscut paper shredders, or other approved method for destroying classified information.”

“All classified information involved in security incidents shall be retained and provided to the certifying official in Block 16 of this DD-254 for classification review.”

“All reports of contractor security violations associated with this contract shall be sent by the DSS field office directly to the certifying official in Block 16 of this DD-254.”

“Forward a copy of subcontractor DD-254s issued under this contract to the official shown in Block 16 of this DD-254.”

“All security related issues, requests, or incidents pertaining to this contract shall be submitted in writing by the contractor’s Facility Security Officer (FSO) to the individual identified in Block 17 of this DD-254. The contractor shall abide by other reporting requirements outlined in the NISPOM.”

"Per the requirements stated in the National Industrial Security Program Operation Manual (NISPOM) dated February 2006, Chapter 5, Section 5, Paragraph 5-502, the Facility Security Officer (FSO) on the prime contract is authorized to flow down access to each subcontractor. It is the prime contractor FSO's responsibility to ensure that all subcontractors have the appropriate access levels. It is also the prime contractor FSO's responsibility to ensure that they have documented paperwork for each subcontract. If the current prime contractor FSO is replaced, it is the responsibility of the new FSO to inform the Naval Undersea Warfare Center Division, Newport, RI in writing to Security and the COR/TOM."

“The program sponsor for this contract is: (Connelly, Michael/Code 409/401-832-1333/ micahel.a.connelly@navy.mil).”

“If the contractor has an OPSEC plan in place, the OPSEC plan will be submitted to the NUWCDIVNPT OPSEC program manager for review. If the Contractor does not have an existing OPSEC plan in place, the contractor will develop an OPSEC plan in accordance with

DI-MGMT-80934C.”

“For contractors seated (long term) on NUWCDIVNPT, the contractor can utilize the NUWCDIVNPT OPSEC program as established by NUWCDIVNPTINST 3070.1 Operations Security in lieu of a Contractor developed OPSEC plan.”

“The FSO shall ensure all personnel receive initial and annual OPSEC awareness training during the life of this contract. The FSO is responsible for maintaining documentation of all OPSEC training requirements. Training can be accomplished via the Defense Security Service (DSS). DSS has an online training program for DoD and DoD Contractors. www.dss.mil.”

“The following Security Classification Guide(s) apply to classified performance on this contract. Subsequent updates shall be provided by the Technical Point of Contact/Contracting Officer Representative/Contracting Officer Security Representative (as applicable) as Government Furnished Information (GFI) and shall be executed by the Contractor without obligation to modify this DD-254.”

-05-78.1 - MK 46 TORPEDO ALL MODS

PREVIOUS EDITION IS OBSOLETE. Page 4 of 5

AEM LiveCycle Designer

DD FORM 254, APR 2018

11(j): The Contractor shall protect critical information associated with this contract to prevent unauthorized disclosure. The NUWC Division Newport (NUWCDIVNPT) Critical Information List, Ser 105/103 of April 05, 2017 (FOUO) is identified under separate cover.

11(j) Continued: Performance under this contract requires the contractor to adhere to OPSEC requirements. OPSEC requirements are additional to the requirements of DoD 5220.22-M, National Industrial Security Program Operating Manual, therefore, the Contractor may not impose OPSEC requirements on its subcontractors unless NUWCDIVNPT approves the OPSEC requirements. The contractor shall assign an OPSEC point of contact for this contract at no additional cost to the Government. This individual may be the Facility Security Officer (FSO).

11(j) Continued: During the period of this contract, the Contractor may be exposed to, use, or produce, NUWCDIVNPT Critical Information (CI) and/or observables and indicators which may lead to discovery of CI. NUWCDIVNPT’s CI will not be distributed to unauthorized third parties, including foreign governments, or companies under Foreign Ownership, Control, or Influence (FOCI).

11(j) Continued: Intra-office communications and electronic emails shall be encrypted and protected when containing NUWCDIVNPT's CI. The transfer of unclassified technical data to and from the government or other associated activities must be accomplished via encrypted email or AMRDEC SAFE https://safe.amrdec.army.mil/safe/ only.

11(j) Continued: Assembled large components/systems being transported to and from testing areas, other production or government facilities (whether or not on public roadways) shall be in an enclosed van trailer or covered flatbed trailer. Component/System outside storage, staging, and test areas shall be shielded/obscured from public view wherever physically possible.

11(j) Continued: NUWCDIVNPT's CI shall not be publicized in corporate wide newsletters, trade magazines, displays, intranet pages or public facing websites. Media requests related to this project shall be directed to NAVSEA/NUWCDIVNPT Public Release Authority listed in Item 12 of this DD Form 254.

11(j) Continued: Any attempt by unauthorized third parties to solicit, obtain, photograph, or record, or; incidents of loss/compromise of government Classified or CI, Business Sensitive, Company Proprietary information related to this or other program must be immediately reported to the Facility Security Officer and Defense Security Service and/or the Naval Criminal Investigative Service, and the NUWCDIVNPT Information, Industrial, and Operations Security POCs identified on this DD-254. Questions concerning these requirements shall be directed to the NUWCDIVNPT Information, Industrial, and Operations Security POCs.

-05-139.3 - MK48 ADCAP (MOD 5 AND BEYOND), MK50, AND MK5

List of Attachments [2] (All Files Must be Attached Prior to Signing, i.e., for any digital signature on the form)

Add Attachment View Selected Attachment Remove Selected Attachment

Operations Security (OPSEC) requirements are imposed for this contract under section 11(j) and are reflected in Item 13 of this DD Form 254.

NAME & TITLE OF REVIEWING OFFICIAL

David Carr, Security Specialist

SIGNATURE

14. ADDITIONAL SECURITY REQUIREMENTS

Requirements, in addition to NISPOM requirements for classified information, are established for this contract.

No Yes If Yes, identify the pertinent contractual clauses in the contract document itself, or provide an appropriate statement which identifies the additional requirements. Provide a copy of the requirements to the CSO. The field will expand as text is added or you can also use item 13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

Operations Security (OPSEC) requirements are imposed for this contract under section 11(j) and are reflected in Item 13 of this DD Form

254. The contractor shall not impose additional security requirements including OPSEC on its subcontractor without written approval from the NUWCDIVNPT OPSEC Program Manager identified on this DD Form 254. These additional security requirements shall not be at an additional cost to the government.

15. INSPECTIONS

Elements of this contract are outside the inspection responsibility of the CSO.

No Yes

PREVIOUS EDITION IS OBSOLETE. Page 5 of 5

AEM LiveCycle Designer

DD FORM 254, APR 2018

If Yes, explain and identify specific areas and government activity responsible for inspections. The field will expand as text is added or you can also use item

13. When removing any expanded text area, use delete key or backspace key, then click out of the text field for it to shrink after the text has been deleted.

(See instructions for additional guidance or use of the fillable PDF.)

16. GOVERNMENT CONTRACTING ACTIVITY (GCA) AND POINT OF CONTACT (POC)

a. GCA NAME

NUWC DIVISION NEWPORT

b. ACTIVITY ADDRESS CODE (AAC) OF THE CONTRACTING OFFICE (See Instructions)

N66604

c. ADDRESS (Include ZIP Code) Code 409 1176 Howell Street Newport, RI 02841

d. POC NAME

Connelly, Michael

e. POC TELEPHONE (Include Area Code)

+1 (401) 832-1333

f. EMAIL ADDRESS (See Instructions) michael.a.connelly@navy.mil

17. CERTIFICATION AND SIGNATURES

Security requirements stated herein are complete and adequate for safeguarding the classified information to be released or generated under this classified effort. All questions shall be referred to the official named below. Upon digitally signing Item 17h, no changes can be made as the form will be locked.

a. TYPED NAME OF CERTIFYING OFFICIAL (Last, First, Middle Initial) (See Instructions)

Lopes, Carlos A

b. TITLE

Security Contracting Offficer

c. ADDRESS (Include ZIP Code) Code 1051 1176 Howell Street Newport, RI 02841

d. AAC OF THE CONTRACTING OFFICE (See Instructions)

N66604

e. CAGE CODE OF THE PRIME CONTRACTOR

(See Instructions.)

f. TELEPHONE (Include Area Code)

+1 (401) 832-6127

g. EMAIL ADDRESS (See Instructions) carlos.lopes@navy.mil

h. SIGNATURE

i. DATE SIGNED (See Instructions)

18. REQUIRED DISTRIBUTION BY THE CERTIFYING OFFICIAL

a. CONTRACTOR

b. SUBCONTRACTOR

c. COGNIZANT SECURITY OFFICE FOR PRIME AND

SUBCONTRACTOR

d. U.S. ACTIVITY RESPONSIBLE FOR OVERSEAS SECURITY

ADMINISTRATION

e. ADMINISTRATIVE CONTRACTING OFFICER

f. OTHER AS NECESSARY (If more room is needed, continue in Item 13 or on additional page if necessary.)

COR

NUWCDIVNPTINST 3070.1B

1053:CAM

23 February 2016

NUWCDIVNPT INSTRUCTION 3070.1B

From: Commanding Officer

Subj: OPERATIONS SECURITY

Ref: (a) NAVSEAINST 3432.1 (series), Naval Sea Systems Command (NAVSEA)

Operations Security (OPSEC) Program Instruction

(b) OPNAVINST 5510.161 (series), Withholding of Unclassified Technical Data from

Public Disclosure

(c) OPNAVINST 3432.1 (series), OPSEC

(d) OPNAVINST 5513.1 (series), Department of the Navy Security Classification Guides

(e) DoD Directive 5205.02, DoD OPSEC Program

(f) 5 U.S.C. Section 552a, Privacy Act of 1974

(g) Naval Undersea Warfare Center Division Newport Critical Information List

Encl: (1) Naval Undersea Warfare Center Division Newport (NUWCDIVNPT) Operations

Security (OPSEC) Plan

1. Purpose. This instruction establishes the policy and assigns the responsibilities for carrying out the NUWCDIVNPT OPSEC plan as directed by references (a) through (e).

2. Cancellation. NUWCDIVNPTINST 3070.1A is cancelled.

3. Administration. This constitutes a major revision and should be read in its entirety.

4. Objective. The objective of this instruction is for the administration of the Command OPSEC program.

5. Scope. This instruction applies to all personnel and activities of NUWCDIVNPT, tenant organizations, contractors, and all range/laboratory/test facility users whether Department of the Navy (DoN), Department of Defense (DoD), or non-DoD.

6. Action. All NUWCDIVNPT personnel, military, civilian, onsite and support contractors, and others assigned to duty at NUWCDIVNPT and its detachments are individually responsible for compliance.

7. Records Management. Records created by this instruction, regardless of media and format, shall be managed per Secretary of the Navy (SECNAV) Manual 5210.1.

HOWARD S. GOLDMAN

Enclosure (1)

NAVAL UNDERSEA WARFARE CENTER DIVISION NEWPORT (NUWCDIVNPT)

OPERATIONS SECURITY (OPSEC) PROGRAM

Enclosure (1)

PREFACE

Operations Security or OPSEC is defined in National Security Decision Directive 298 as the process of denying adversaries information about friendly capabilities and intentions by identifying, controlling, and protecting indicators associated with planning and conducting sensitive government activities.

The goal of OPSEC is to deny our adversaries information that is of value to them; in effect, information that furthers an adversary’s military, technological, economic, and political objectives against the United States. Techniques were developed during the Vietnam conflict that have been refined and put into practice in OPSEC concept and process methodology.

This plan discusses that methodology and its genesis in detail and shall be used as a basis for the development of OPSEC programs tailored to the special concerns of individual operations at Naval Undersea Warfare Center Division Newport (NUWCDIVNPT), including all ranges, sites, and detachments.

Enclosure (1) i

TABLE OF CONTENTS

SECTION PAGE

1 INTRODUCTION

1.1 Background

1.2 The Opsec Process

1.3 Purpose

2. OPSEC PLANNING GUIDANCE/REQUIRED PLANS

2.1 Requirements for Secrecy

2.2 Required Plans

3 CRITICAL INFORMATION

3.1 Sensitive Information

3.2 Sources of Information

4 THE HOSTILE INTELLIGENCE THREAT

5 VULNERABILITIES

6 COUNTERMEASURES

6.1 For Official Use Only (FOUO) Information

6.2 OPSEC Countermeasures

7 TRAINING PROGRAM

7.1 Basic Orientation

7.2 Continuing Awareness

7.3 OPSEC PM Training

APPENDIX A—TERMINOLOGY............................................................................................ A-1

APPENDIX B—OPSEC PROCESS .......................................................................................... B-1

APPENDIX C—VULNERABILITIES ...................................................................................... C-1

APPENDIX D—SAMPLE OPSEC PLAN (ANNEX) .............................................................. D-1

APPENDIX E—OPSEC SURVEYS ........................................................................................... E-1

Enclosure (1) 1

1. INTRODUCTION

1.1 BACKGROUND

a. One of the prime objectives of the U.S. intelligence community is to acquire critical information (CI) regarding the research, development, testing, and evaluation (RDT&E) of foreign military weapons systems and associated hardware. Conversely, there is no doubt that potential U.S. adversaries are also very interested in our military systems development efforts.

b. The purpose of hostile foreign intelligence collection efforts is to determine general developmental trends of future U.S. weaponry; to obtain data about specific weapons in order to devise countermeasures and counter-tactics, and to acquire advanced technology that could possibly reduce developmental time and money associated with their own military hardware programs. The development and initial testing phases of a weapon system is a prime target for hostile intelligence collection.

c. OPSEC is the process that shall be used in the RDT&E community to maintain the element of surprise regarding the development of U.S. weapon systems. OPSEC focuses on identifying and protecting the specific information needed by an adversary to undermine the effectiveness of a specific operation or fielded weapon system.

d. As applied to the RDT&E community, OPSEC is the identification and protection of the specific CI needed by an adversary to develop countermeasures and counter-tactics, or that could be crucial in the transfer of technology; determining where the CI is vulnerable; and implementing countermeasures to the exploitation of those vulnerabilities. The CI that must be protected need not be classified and often is seemingly innocent and unimportant when examined in isolation.

e. It is also vital that the NUWCDIVNPT OPSEC program develop training and awareness programs to raise the consciousness and capabilities of NUWCDIVNPT personnel to the protection of this information.

f. OPSEC remains the functional responsibility of the military commander, the program manager, and those who direct government operations and functions. In the R&D environment, a good OPSEC program will prolong the useful or competitive life of new weapons, high-technology systems, and sensitive programs.

g. The methodology used to implement OPSEC at RDT&E facilities and in specific programs is the OPSEC survey (Appendix E) or vulnerability assessment, per reference (e).

Surveys are conducted per Appendix E. Vulnerability assessments shall be conducted annually.

Enclosure (1) 2

1.2 THE OPSEC PROCESS

OPSEC is a continuous systematic process, encompassing security and common sense. It can be applied to any program, plan, or operation. The five basic steps below are explained in detail in Appendix B:

1. Identifying Critical Information

2. Threat Analysis

3. Vulnerability Analysis

4. Risk Assessment

5. Countermeasures

1.3 PURPOSE

a. The purpose of this directive is to provide NUWCDIVNPT personnel with a better understanding of the threat posed by hostile intelligence collection, to identify NUWCDIVNPT vulnerabilities that could be exploited by an adversary, and to identify countermeasures that can be implemented to counter the threat.

b. This directive discusses the OPSEC methodology in detail and shall be used as a basis for the development of individual OPSEC plans and actions tailored to the special concerns of all codes, programs, projects, and contractors conducting operations at NUWCDIVNPT.

Appendixes A through E provide a list of terms, a five-step OPSEC analysis, a list of known vulnerabilities, a sample OPSEC Plan (Annex), and OPSEC survey information. Site-specific detachment OPSEC plans are available from the respective program managers or the NUWCDIVNPT OPSEC Program Manager (PM) (Code 1053).

2. OPSEC PLANNING GUIDANCE/REQUIRED PLANS

2.1 REQUIREMENTS FOR SECRECY

a. The primary purpose of NUWCDIVNPT is to acquire, process, and distribute information associated with the RDT&E of military devices and systems associated with underwater weapons, acoustics, communications systems, and other related systems. Much of this information is potentially vulnerable to unauthorized interception.

b. The interception of military data can enable hostile governments to devise similar capabilities at much reduced cost and/or develop defensive systems and devices to nullify the effectiveness of new weapons before they become operational. The protection of information about NUWCDIVNPT capabilities, operations, and other activities from interception is essential for preservation of our military advantage.

Enclosure (1) 3

2.2 REQUIRED PLANS

When required by the NUWCDIVNPT OPSEC PM, projects, programs, events, and functions initiated, planned, conducted, and/or supported by elements of NUWCDIVNPT that have sensitive unclassified aspects will have specific, detailed OPSEC plans. These plans will ensure unclassified information (of military significance that could be of intelligence value to a hostile government) shall be properly protected and disseminated only on a strict need-to-know basis. Appendix B provides a five-step process for developing OPSEC plans. Intelligence value is knowledge that can be evaluated and interpreted, or give knowledge of where and/or how such knowledge can be obtained, to provide indicators of U.S. military capabilities, limitations, vulnerabilities, and/or probable intentions. Appendix D presents a sample format to assist in the development of individual OPSEC plans.

3. CRITICAL INFORMATION

CI is defined as information important to the successful achievement of objectives and missions, or that may be of use to an adversary. An alternate valid definition is as follows: CI is information about friendly activities, intentions, capabilities, or limitations that an adversary needs in order to gain a military, political, diplomatic, or technological advantage, per references (a), (c), and (e) through (g). Such information, if released to an adversary prematurely, may prevent or forestall mission accomplishment, reduce mission effectiveness, or cause loss of lives and/or damage to friendly resources.

3.1 SENSITIVE INFORMATION

a. Information whose loss, misuse, unauthorized access to, or modification of, could adversely affect the national interest, the conduct of federal programs, or the privacy to which individuals are entitled under 5 U.S.C. Section 552a (the Privacy Act) reference (f), but that has not been specifically authorized under criteria established by an Executive Order or an Act of Congress to be kept safeguarded in the interest of national defense or foreign policy.

b. All CI is considered sensitive information as defined above. A listing of CI that may have application to activities at NUWCDIVNPT is maintained in a separate document. The Critical Information List (CIL), reference (g), shall be updated annually.

3.2 SOURCES OF INFORMATION

In addition to the covert gathering of information by hostile intelligence collectors, there are open sources of information and detectable activities that may totally or partially answer Essential Elements of Friendly Information (EEFI). The NUWCDIVNPT CIL helps personnel better understand how sensitive information can be of value to an Intelligence Collector, and can be provided through open sources. It will also be of value to persons preparing OPSEC plans.

Enclosure (1) 4

4. THE HOSTILE INTELLIGENCE THREAT

a. The primary hostile intelligence collection capability facing NUWCDIVNPT is the ability of hostile intelligence services (HOIS) to actively collect classified and/or sensitive unclassified information.

b. Frequent, well-publicized cases of espionage serve as ample evidence that hostile elements go to considerable effort to obtain information about U.S. weapons systems. Thus, it would be foolhardy and negligent not to assume that an important RDT&E facility, such as NUWCDIVNPT, would not be targeted by a foreign intelligence service.

c. Due to the concentration of high technology industries and military operations in the eastern U.S., it is estimated that HOIS are very active in this area. The current threat is multidimensional, highly sophisticated, and extremely dedicated. HOIS have the ability and motivation to collect classified and sensitive information utilizing human intelligence (HUMINT), signal intelligence (SIGINT), and imagery intelligence (IMINT) resources.

d. Collection of information concerning a technology or its application to a weapon system or other military capability can be compared to putting together the pieces of a puzzle.

Any or all of the various intelligence collection methods may be used to identify these pieces and their place in the puzzle. To alert personnel associated with NUWCDIVNPT operations and programs to the multidimensional intelligence collection threat, an examination of each of the three major collection disciplines and their subcategories follows.

(1) HUMINT: Intelligence derived from information collected or provided by human sources. Typical HUMINT activities consist of interrogations and conversations with persons having access to information. HUMINT can provide several kinds of information. It can provide observations during travel or other events from travelers, refugees, etc. It can provide data on things about which the subject has specific knowledge, which can be another human subject or, in the case of defectors and spies, sensitive information to which they had access. Finally, it can provide information on interpersonal relationships and networks of interest.

(2) SIGINT: Intelligence-gathering by interception of signals, whether communications between people, “communications intelligence” (COMINT), or from electronic signals not directly used in communication, “electronic intelligence” (ELINT).

Sensitive information is often encrypted. As such, SIGINT often involves the use of cryptanalysis to decipher the messages. Traffic analysis, the study of who is signaling whom and in what quantity, is also used to derive information. Since the invention of the radio, the international consensus has been that radio waves are no one’s property, thus the interception itself is not illegal. However, there can be laws on who is allowed to collect, store, and process radio traffic and for what purpose.

(3) IMINT: Intelligence derived from the collection and exploitation of visual photography, infrared sensors, lasers, electro-optics, and radar sensors such as synthetic aperture radar wherein images of objects are reproduced optically or electronically on film, Enclosure (1) 5 electronic display devices, or other media. IMINT can be derived from sources ranging from personal cameras, pictures from open source documentation, Open Sky fly-overs, publicly available satellite imagery such as Google Maps, and government owned spy satellites.

5. VULNERABILITIES

OPSEC vulnerabilities are weaknesses in security measures, operational practices, and procedures that can be exploited by, and are accessible to, a hostile intelligence attack. OPSEC vulnerabilities reflect the most lucrative source of information normally targeted by hostile intelligence collection operations. Known common vulnerabilities among RDT&E facilities are provided in Appendix C.

6. COUNTERMEASURES

a. A countermeasure is any action taken to eliminate or reduce a vulnerability to hostile collection. Per references (a) and (c), when developing countermeasures, consideration should be given to on-the-spot corrections that effectively minimize or neutralize identified vulnerabilities. Low-cost/no-cost solutions should be sought and emphasized. Such recommendations may be of a temporary or permanent in nature. Temporary recommendations to neutralize vulnerabilities usually relate to an event, when the event has concluded, or further action is usually no longer required. Where extensive corrections must be taken or high costs are involved, recommendations should be prioritized to permit an incremental approach for adoption that is phased over a period of time.

b. The decision on what countermeasures to implement relates directly to risk versus cost/benefit. The countermeasures identified herein are not all inclusive, and any organization, contractor, or subcontractor in support of programs/projects at NUWCDIVNPT that may require additional countermeasures shall contact the OPSEC PM.

6.1 FOR OFFICIAL USE ONLY (FOUO) INFORMATION

a. Access to FOUO material shall be limited to those employees who need the material to do their job. FOUO material shall be handled in a way to preclude its disclosure to the general public and to limit its circulation.

b. The marking “FOR OFFICIAL USE ONLY” shall be stamped or marked in bold letters at least 3/16 of an inch in height at the top and bottom of those pages that contain FOUO information. The abbreviation FOUO shall not be used for marking purposes.

6.2 OPSEC COUNTERMEASURES

Enclosure (1) 6

The application of OPSEC countermeasures could involve any of the issues discussed previously in this directive. In addition, there are a number of significant areas that have not been addressed to this point as they do not specifically fall into any of the categories in this plan.

These miscellaneous countermeasures have been grouped here under OPSEC:

a. Contracts. All contracts involving classified work shall include language ensuring the application of OPSEC principles per reference (c) and this instruction. All contracts, whether involving classified work or not, that require onsite contractors at NUWCDIVNPT shall require the contract language to ensure onsite contractors receive all necessary training in OPSEC principles per reference (c) and this instruction commensurate with the training that government personnel receive. The details of contracts either generated or performed at NUWCDIVNPT can be of value to HOIS. Contract information, even though unclassified, needs to be restricted in its dissemination to the minimum number of recipients possible.

b. Public Release. No material shall be given public release without an OPSEC review being conducted according to established procedures, per references (a) through (c), and (e) through (g). The NUWCDIVNPT Public Affairs Office is the only authorized releasing official.

(1) Contractors shall clear all releases through project offices or with the NUWCDIVNPT Contracting Officer’s Representative, who shall ensure established NUWCDIVNPT procedures are followed.

(2) Information published in any public media, government media, technical journals, speeches, etc., that has no restrictions or controls on who may receive the material is to be considered a “Public Release.”

c. Technology Transfer. Strict adherence to NUWCDIVNPT guidelines in the release or transfer of critical technology data is mandatory. Material information or data controlled by the Militarily Critical Technology List, the International Traffic in Arms Regulation, the Commodities Control List, or the United States Munitions List can be released under controlled conditions as specified by each respective source.

d. Miscellaneous Issues. In most cases, any activity or function can have OPSEC applied in some fashion. It is not possible to cover in this plan all instances where OPSEC could be utilized. With a little thought and common sense, those activities with OPSEC potential that do not fall into one of the categories previously covered should be apparent. For example:

(1) The supply function can be a lucrative source of information on NUWCDIVNPT activities. The kind of parts, equipment, and services procured can be a clear indicator of activities, operational capabilities, projects, and programs.

(2) Personnel actions (recruitments, transfers, training, etc.) can furnish valuable information relating to NUWCDIVNPT projects, programs, and the types of technologies underway or planned.

Enclosure (1) 7

(3) Finance and management information can be very sensitive. Program and project level effort and priorities can be clearly deduced by analyzing financial data.

(4) Travel information reflecting types of meetings, contacts, and subject areas for key NUWCDIVNPT personnel should be controlled. Such information can be of value to HOIS analysts.

(5) Corporate plans (long-range and short-range), standard operating procedures (SOPs), emergency plans, etc., may all have OPSEC potential. Planners must keep in mind that their products, even though unclassified, need to be reviewed for OPSEC application throughout the planning process.

7. TRAINING PROGRAM

For OPSEC to be effective, all personnel at NUWCDIVNPT shall understand the concept of OPSEC and apply that knowledge and awareness in the performance of assigned tasks. For the OPSEC training program to be meaningful over the long term, it shall be relevant to the jobs assigned per reference (c) and (e).

7.1 BASIC ORIENTATION

Each new employee (military and civilian) assigned to an organizational element at NUWCDIVNPT shall receive an OPSEC briefing as part of NUWCDIVNPT’s “New Employee Security Orientation Program.” This briefing shall occur within 60 days of reporting on board.

7.2 CONTINUING AWARENESS

Ongoing OPSEC awareness programs shall be provided for all personnel (military and civilian). OPSEC awareness programs shall be updated continuously to ensure the most current information is available on OPSEC-related issues. The continuing awareness program shall utilize the all-hands electronic messages/article systems. All training requirements shall be coordinated through the Naval Sea Systems Command (NAVSEA) and NUWCDIVNPT Workforce Development Branch.

7.3 OPSEC PM TRAINING

The OPSEC PM shall attend OPSE 2380 (OPSEC Analysis Course) and OPSE 2390 (OPSEC Program Management Course) within 90 days of appointment. Although there are no prerequisites for this training, the OPSE 1301 (OPSEC Fundamentals) course is recommended.

Online training is provided by the Interagency OPSEC Support Staff (IOSS).

Enclosure (1) 8

7.4 OPSEC COORDINATOR TRAINING

The coordinators shall complete the OPSE 1301 course upon appointment by their respective Department Head. Online training is provided by the IOSS.

Enclosure (1) A-1

APPENDIX A

TERMINOLOGY

1. Access or Accessibility. Access or accessibility refers to the ability and opportunity to obtain knowledge of classified or sensitive unclassified information. An individual may have access to information by being in a place where such information is kept, if the security measures that are in force do not prevent that person from gaining knowledge of the information.

2. Appreciations. Appreciations are assumptions, estimates, and facts about an opponent’s intentions and military capabilities that are used in planning and decision making:

a. Desired Appreciations. Adversary estimates that result in adversary intentions and military capabilities to friendly advantage.

b. Essential Secrecy. Specific unknowns or uncertainties that prevent or hinder adversary derivation of accurate estimates or knowledge of facts, and effective planning and decision making.

c. Harmful Appreciations. Adversary assumptions or estimates to provide for unknowns or uncertainties, or necessary and sufficient known facts that result in adversary intentions and military capabilities to friendly disadvantage.

3. Authorized Persons. Authorized persons have a need-to-know for the information involved and have been cleared for the receipt of such information. Responsibility for determining whether a person’s duties require that they possess, or have access to, any information, and whether they are authorized to receive it, rests on the individual who has possession, knowledge, or control of the information involved, and not on the prospective recipient.

4. Classification Guide. A classification guide is a document issued by an authorized original classifier that prescribes the level of classification and appropriate declassification instructions for specified information to be classified derivatively.

5. Classified Information. Classified information is information or material that is: (a) owned by, produced by or for, or under the control of the U.S. Government; (b) determined under Executive Order 13526 or prior orders to require protection against unauthorized disclosure; and

(c) so designated.

6. Command, Control, Communications, Computers, Collaboration, and Intelligence (C5I). C5I are the capabilities required by commanders to exercise command and control of their forces, including capabilities to:

a. Obtain, report, communicate, process, analyze, synthesize, display, and disseminate information to support command planning and decision making.

b. Formulate alternative courses of action.

Enclosure (1) A-2

c. Exercise decision making roles.

d. Communicate orders to subordinates and receive the results of actions and the status of forces.

7. Communications Security (COMSEC). A component of Information Assurance that deals with measures and controls taken to deny unauthorized persons information derived from telecommunications and to ensure the authenticity of such telecommunications. COMSEC includes cryptographic security, transmission security, emissions security, and physical security of COMSEC material:

a. Cryptographic Security. The component of COMSEC that results from the provision of technically sound crypto-systems and their proper use.

b. Transmission Security. Measures (security controls) applied to transmissions in order to prevent interception, disruption of reception, communications deception, and/or derivation of intelligence by analysis of transmission characteristics such as signal parameters or message externals.

c. Emission Security. The component of communications security that results from all measures taken to deny unauthorized persons information of value that might be derived from intercept and analysis of compromising emanations from crypto equipment and information systems.

d. Physical Security. All physical measures necessary to safeguard classified and sensitive unclassified equipment, material, and documents from access thereto or observation thereof by unauthorized persons.

8. Compromise. Disclosure of information to unauthorized persons, or a violation of the security policy of a system in which unauthorized intentional or unintentional disclosure, modification, destruction, or loss of an object may have occurred.

9. Compromising Emanations. Unintentional signals that, if intercepted and analyzed, would disclose the information transmitted, received, handled, or otherwise processed by telecommunications or information systems equipment.

10. Controlled Information. Information and indicators deliberately conveyed or denied to foreign targets in order to evoke invalid official estimates that result in foreign official actions advantageous to U.S. interests and objectives.

11. Countermeasures. Anything that effectively negates or mitigates an adversary’s ability to exploit vulnerabilities.

Enclosure (1) A-3

12. Cover. Cover is military deception that causes misinterpretation of and minimal concern or curiosity about observables that are generated by operations and other activities. Covers are targeted not only at adversaries, but also at random observers and sometimes at personnel with access to classified information.

13. Critical Information (CI). Information about friendly activities, intentions, capabilities, or limitations that an adversary needs to gain a military, political, diplomatic, or technological advantage.

14. Deception Means. Deception means are methods, resources, and techniques that can be used to convey or deny information:

a. Administrative Means. Resources, methods, and techniques designed to convey or deny oral, pictorial, documentary, or other physical evidence.

b. Physical Means. Activities and resources used to convey or deny selected information.

(Examples: military operations, including exercises, reconnaissance, training activities, and movement of forces; the use of dummy equipment and devices; tactics; bases, logistic actions, stockpiles, maintenance, and repair activities; and test and evaluation activities.)

c. Technical Means. Military material resources and their associated operating techniques used to convey or deny selected information through the deliberate radiation, re-radiation, alteration, absorption, or reflection of energy; the emission or suppression of chemical or biological odors; and the emission or suppression of nuclear particles.

15. Document. A document is any recorded information, regardless of its physical form or characteristics, exclusive of machinery, apparatus, equipment, or other items of material. The term includes, but is not limited to, the following: all written material (whether handwritten, printed, or typed); all photographs, negatives, exposed or printed films, and still or motion pictures; all data processing files, cards, or tapes; maps; charts; paintings; drawings; engraving;

sketches; working notes and papers; all reproduction of the foregoing by whatever process reproduced; and sound/voice of electronic recordings in any form.

16. Electronic Intelligence (ELINT). Technical and geolocation intelligence derived from foreign non-communications transmissions (e.g., radar) by other than nuclear detonations or radioactive sources.

17. Electronic Security (ELSEC). ELSEC is the protection resulting from all measures designed to deny unauthorized persons information of value that might be derived from their interception and study of non-communications electromagnetic radiations, (e.g., radar).

18. Emission Control. Emission control is the selective and controlled use of electromagnetic, acoustic, or other emitters to optimize command and control capabilities (while minimizing, for OPSEC, detection by enemy sensors); to minimize mutual interference among friendly systems;

and/or to execute a military deception plan.

Enclosure (1) A-4

19. Enterprise Protection Risk Management (EPRM). EPRM is a Secure Internet Protocol Router Network (SIPRNET)-based program that provides commands and commanding officers the ability to view enterprise-wide assessments across multiple functional areas to help make informed decisions on where to best allocate resources.

20. Essential Elements of Information. In the context of “friend or foe,” these are specific pieces of information that are likely to be sought by…