OPSEC_PLAN_2025.pdf

ARMY CONTRACTING COMMAND – DETROIT ARSENAL

OPERATIONS SECURITY PLAN

POC: Shawn O’Neill, (586) 909-8744

Controlled By: ACC-DTA CUI Category: OPSEC Limited Dissemination Control: FEDCON

Distribution Restriction Statement

This document will not be sent over the internet unencrypted or posted to any public websites.

Destruction Notice

Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

Proponent and Exception Authority

The proponent of this OPSEC Plan is ACC-DTA. Submit recommended changes and/or corrections to ACC-DTA OPSEC Officer.

CUI 1

Record Of Review Date Reviewed Reviewed By Signature Comments

CUI 2

Contents

1. (U) REFERENCES:

2. (U) GENERAL:

3. (U) APPLICABILITY:

4. (U) CONCEPT OF IMPLEMENTATION:

5. (U) RESPONSIBILITIES:

6. (U) OPSEC IN CONTRACTING. See Annex D

7. (U) THE INTELLIGENCE COLLECTION THREAT:

8. (U) OPSEC MEASURES:

9. (U) POINT OF CONTACT:

ANNEX A: CRITICAL INFORMATION LIST (CIL) AND ESSENTIAL ELEMENTS OF

FRIENDLY INFORMATION (EEFI)

ANNEX B: CONTROLLED UNCLASSIFIED INFORMATION (CUI)

MARKING CUI………………………………………………………………………………………22

ANNEX C: OPSEC REVIEW……………………………………………………………………………….23

7114 Form………………………………………………………………………………………………….24

ANNEX D: OPSEC IN CONTRACTING (STA 255)

The STA 255 form………………………………………………………………………27

ANNEX E: DOCUMENT DESTRUCTION AND DISPOSAL

ANNEX F: OPSEC FOR THE FAMILY

CUI 3

1. (U) REFERENCES:

a. AR 530-1 (Operations Security), 26 September 2014

b. Army Contracting Command Operations Security Plan, 15 May 2025.

2. (U) GENERAL: ACC-DTA’s Mission Statement. “ACC Detroit Arsenal delivers decisive contracting solutions across the full spectrum of conflict in support of the Army and Joint Force Multi-Domain Operations - Anytime, Anywhere”. To protect the success of this mission the use of OPSEC (Operations Security) is essential.

What is Operations Security? It is a tool used to deny our adversaries access to our critical and sensitive information.

a. (CUI) Purpose. The purpose of OPSEC is to strengthen ACC-DTA’s ability to prevent the inadvertent compromise of sensitive or unclassified information, activities, capabilities, or intentions at tactical, operational, or strategic levels.

ACC-DTA will conduct an aggressive OPSEC program designed to improve mission effectiveness through the identification and elimination of potential OPSEC vulnerabilities. OPSEC is an operations function. The OPSEC objective is to deny our adversaries access to critical information and technologies that are sensitive and, if disclosed, could seriously impact our programs.

b. (CUI) Threat. Capable adversaries collect unclassified information on ACC-DTA.

A formal threat assessment is available (contact ACC-DTA ATO). The worldwide intelligence collection threat is comprised of multi-disciplined, highly sophisticated, and extremely dedicated adversaries. Their collection efforts potentially target all DoD operations, especially those related to a mission or operation closely related to one of their primary intelligence requirements.

c. (U) Critical Information (CI). CI is that information that an adversary would need to interfere with friendly activities or operations, or to be successful in their mission. The CI list should also include any information uniquely essential to friendly objectives. Understanding the adversary and their information requirements is essential to correctly identifying CI.

d. (U) Vulnerability Analysis. Vulnerabilities (and indicators) of the program may reveal unclassified critical information. A general and contractual vulnerability analysis is provided below.

1) (U) Lack of OPSEC Awareness. Personnel do not fully realize their OPSEC responsibilities. Employees are not aware of the extent to which adversaries depend on obtaining unclassified information on a defense project and their

CUI 4

capabilities to derive important intelligence data from unclassified critical information.

2) (U) Open-Source Information. Unclassified information released to the news media (i.e., through meetings, seminars, conferences and exhibitions, contractor advertisements, company websites, blogs, emails, professional journals, research papers, conference presentations, resumes, newsletters, etc.) may provide adversaries with valuable information regarding individual systems capabilities, limitations, and technical operations.

3) (U) Staff use of social media. Social media is a unique form of web page and represents a higher level of risk because they are designed specifically for people to share information. Adversaries exploit social media by using it to target individuals, by using social engineering to elicit information, and to gather intelligence.

4) (U) Professional Conferences/Symposia. Company personnel are susceptible to elicitation and exploitation when attending these events by fellow participants who covertly represent the intelligence collection agencies of foreign governments. Collection efforts may range from innocuous questions from foreign scientists to blackmail by intelligence agents. Without constant awareness of the threat, project personnel may inadvertently release information of analytical value.

5) (U) Communications. All unsecured telephone conversations, including faxes, cell phones, and Voice over IP (VoIP) conversations, are vulnerable to monitoring. Email and attachments are also vulnerable to interception and monitoring.

6) (CUI) Visitor Control. Visitors within the facility may observe or overhear unclassified critical information regarding operations, activities, etc.

7) (CUI) Conference Room Security. Unclassified critical information can be compromised if there are no procedures in place to control discussions.

8) (CUI) Contracting. Companies may fail to recognize the need for the obligation of OPSEC requirements in contracts and subcontracts.

9) (U) Disgruntled Employees and Employees with Personal Problems.

Personnel possessing security clearances may, through personal adversities or circumstances such as marital difficulties, criminal behavior, excessive indebtedness, and/or indiscriminate use of alcohol, present attractive targets to intelligence services. Supervisors and/or fellow employees may become aware of these difficulties but may fail to notify management or security to investigate, electing to ignore the problem or rationalizing that some other party will take action. Non-action on the part of personnel who become aware

CUI 5

of these situations can be as significant as that presented by an adversary who may attempt to exploit personnel experiencing these problems.

e. (U) Contractual Vulnerability Analysis. The following contractual vulnerabilities are most identified in OPSEC assessments:

1) Travel patterns, and poor travel practices (whether TDY or vacation).

2) Sympathies of personnel for adversary countries.

3) Lack of procedures or failure to comply with those developed for controlling visits.

4) Lack of procedures or failure to comply with procedures regarding information release to international partners and subcontractors; and,

5) Unauthorized access to specific unclassified performance parameters related or identified with the program.

3. (U) APPLICABILITY: This OPSEC Plan is applicable to all Soldiers, Department of the Army (DA), Civilians, Family members, and Department of Defense (DoD) contractors assigned to ACC-DTA. All future references to ACC-DTA also include the subordinate units below:

CUI 6

4. (U) CONCEPT OF IMPLEMENTATION:

a. This plan is implemented through the lenses of the 6 step OPSEC process:

1) Analyze Threats. Identify those actions that are observable by adversaries.

2) Identify critical information. Ask what information needs to be protected.

3) Analyze vulnerabilities. Determine indicators and vulnerabilities an adversary intelligence system might obtain to be able to interpret or piece together to derive critical information in time to use against U.S. and/or friendly missions posing an unacceptable risk.

4) Assess risk. Select and execute measures that eliminate or reduce the risk to friendly actions and operations or reduce them to an acceptable level.

5) See paragraph 8 for information on countermeasures.

6) Reassess for effectiveness.

CUI 7

5. (U) RESPONSIBILITIES:

a. ACC-DTA Executive Director.

1) Appoint primary and alternate OPSEC Officers, in writing, with responsibility for the execution of the OPSEC program for ACC-DTA. Ensure they are of sufficient rank/grade to execute their responsibilities.

2) Ensure the appointed primary and alternate OPSEC Officers receive the required IOSS training.

3) Annually, or as needed, approve ACC-DTA’s Critical Information List (CIL), OPSEC Measures, and OPSEC Plan developed and maintained by the ACC- DTA OPSEC Officer. Approval to be documented on the Commander’s annual OPSEC review memorandum that is to be appended to the OPSEC plan each year the plan is in effect.

4) Ensure dissemination to all personnel and subordinate elements as widely as security permits.

b. ACC-DTA OPSEC Officers.

1) Follow established guidance in AR 530-1, HQ ACC OPSEC Plan, and OPSEC guidance and policies of the local host installation/facility.

2) Be appointed in writing, and complete OPSEC Level II training.

3) Establish a documented OPSEC Program.

4) Identify the command’s critical and sensitive information and establish a critical information list, to clearly develop and define the specific OPSEC measures that all personnel should practice. Provide critical information list and OPSEC Measures to the Director for review and signature. Update annually or as needed.

5) Coordinate, as needed, with HQ-ACC to receive support for funding, Staff

Assistance Visits (SAV), document writing and templates, assistance, and guidance, as needed.

6) Maintain liaison with other United States Army Garrison-Detroit Arsenal (USAG-

DTA) tenants. Attend OPSEC working groups.

CUI 8

7) Provide an OPSEC briefing during in-processing for all soldiers, civilians, and fellows. Ensure an OPSEC briefing is provided within 30 days of individual reporting to the organization.

8) Provide and document OPSEC awareness material for ACC-DTA personnel, to maintain a high level of OPSEC awareness.

9) Monitor the completion of OPSEC Level 1 training for all ACC-DTA personnel.

10) Use the OPSEC Review Form (STA 7114), to conduct OPSEC reviews on, but not limited to, memorandums, letters, e-mail messages, articles, academic papers, videos, web sites, briefings, ACC-DTA specific contract requirement packages, requests for information, news releases, technical documents, proposals, plans, orders, ACC-DTA’s comments to audit recommendations, social media message boards, blogs, or other visual or electronic media, prior to release in the public domain.

11) Ensure ACC-DTA subordinate sites receive OPSEC support at their respective locations and assess accordingly.

12) Submit, in accordance with AR 530-1 and HQ, ACC OPSEC Plan, the annual OPSEC Program Status Report to HQ-ACC.

13) Conduct quarterly OPSEC reviews of ACC-DTA publicly accessible web sites or social media pages.

14) Pursuant to ALARTACT 015-2012, review contractual documents initiated by ACC-DTA for OPSEC requirements, utilizing the Contract Requirements Package Antiterrorism/Operations Security Cover Sheet, STA Form 255 (see Appendix D).

15) Submit OPSEC funding requirements through ACC-DTA’s budgeting process.

c. ACC-DTA Public Affairs Officer (PAO):

1) Ensure that material proposed for public release that mentions the Army Contracting Command-Detroit Arsenal plans, policies, programs, operations, budget, personnel, or activities is cleared through Public Affairs Office and OPSEC channels.

2) Consider OPSEC in all public affairs operations IAW AR 525-13, AR 530-1 and AR 360-1.

CUI 9

3) Comply with Federal, DoD and DA website administration policies and content-approval procedures that include OPSEC and public affairs reviews before updating or posting information on official websites.

4) Ensure public affairs communication products include OPSEC awareness messages when applicable. The author/originator providing the information, materials, or records to the public affairs office for public release ensure proper OPSEC reviews utilizing STA Form 7114.

5) Ensure all official Army social media sites under ACC-DTA adhere to guidance of DoD Instruction 5400.17, ALARACT 073/2022 and Army social media guidance found at https://www.army.mil/socialmedia/.

6) Conduct quarterly reviews of ACC-DTA official public websites to ensure compliance with DoD Instruction 5400.17, ALARACT 073/2022, AR 25-1.

7) Provide unclassified information about the Army and its activities to the public with maximum disclosure and minimum delay, ensuring any information released would not adversely affect national security, threaten personal safety, or invade the privacy of members of the Armed Forces.

8) Ensure that the release of information about personnel casualty matters adheres to current policies and procedures guidelines (DoDI 1300.18).

d. All Soldiers, Department of the Army Civilians, and DoD Contractors.

1) Receive OPSEC awareness training, both as a new hire and annually.

2) Contact an OPSEC Officer to ensure an OPSEC review is performed on memorandums, letters, email messages, articles, academic papers, videos, websites, briefings, contract requirement packages, request for information, new releases, technical documents, proposals, plans, orders, social media message boards, blogs, or other visual or electronic media, prior to release. Also coordinate with the PAO for guidance before sensitive or critical information is released outside the organization or to the public.

3) Understand how OPSEC complements traditional security programs to maintain essential secrecy of U.S. military capabilities, intentions, and plans.

4) Understand how adversaries aggressively seek information on U.S. military capabilities, intentions, and plans https://www.army.mil/socialmedia/

CUI 10

5) Become knowledgeable of ACC-DTA’s critical information and how to protect it by applying OPSEC measures to prevent inadvertent disclosure.

6) Implement OPSEC measures as determined by the Executive Director.

7) Utilize OPSEC when utilizing communication devices (i.e., MS Teams)

8) Limit distribution of classified information and CUI (legacy FOUO) to those individuals with a valid need to know and the correct eligibility. See Annex B.

9) Refrain from discussing work issues in public locations where conversations can be overheard.

10) Ensure all hardcopy CUI (legacy FOUO), technical data and documents are destroyed IAW current shredding standards for CUI identified in the memo, CUI Notice 2019-03: Destroying Controlled Unclassified Information (CUI) in paper form date 15 July 2019. See Annex B.

11) Be familiar with this OPSEC Plan and where to obtain additional OPSEC guidance.

12) Handle any attempt by unauthorized personnel to solicit sensitive or critical information as a counterintelligence incident.

13) Report all facts immediately to the nearest supporting counterintelligence office and ACC-DTA Security.

14) Know and protect ACC-DTA’s Critical Information List (CIL). See Annex A.

15) Prevent the disclosure of critical and sensitive information in any public domain to include but not limited to the internet, open-source publications, and the media. Be aware that personal social media sites, weblogs and/or emails cannot be created or maintained during working hours.

16) Refrain from publicly disseminating or publishing photographs that display critical or sensitive information.

17) Refrain from referencing, disseminating, or publishing critical or sensitive information that has already been compromised as this provides further unnecessary exposure of the compromised information and may serve to draw undue attention to it.

CUI 11

18) Promptly report OPSEC and security violations to your supervisor and ACC-DTA Security so mitigation efforts can be quickly initiated, and a damage assessment can be conducted.

19) Ensure that an OPSEC review (STA Form 7114) is initiated on all information being considered for public release. See Annex C.

20) Ensure that the most current version of the AT/OPSEC in contracting form (STA Form 255) is used when preparing contract documents or when modifying contracts. See Annex D.

21) Understand the general threats in opposition to ACC-DTA’s mission. For questions regarding these threats, please contact Shawn O’Neill, 586-909-8744.

6. (U) OPSEC IN CONTRACTING. See Annex D.

7. (U) THE INTELLIGENCE COLLECTION THREAT:

a. (CUI) General Threat and Open-Source Threat. The ACC-DTA mission offers many opportunities for adversaries to attempt to collect information through requests for information, social engineering, surveillance and observation, acquiring business on ACC-DTA contracts, posing as a job seeker, or using traditional intelligence collection methods. The availability of open-source information is increased by the number of conferences, seminars, and exhibitions that are held throughout the United States. Open-source collection is the easiest and least expensive method of collection to employ.

b. (CUI) Foreign Intelligence Services (FIS). There are official foreign establishments (businesses) throughout ACC-DTA’s area of responsibilities (AOR). Many of these establishments provide cover for foreign intelligence agents. FIS has the capability to conduct many different types of intelligence collection methods creating possible vulnerabilities for ACC-DTA operations.

ACC-DTA employed countermeasures must ensure that controlled unclassified information or classified information is not inadvertently disclosed.

c. (CUI) Terrorists. Terrorist organizations target information that could be used for future attacks against the United States. The following types of information are targets of interest for terrorist organizations:

1) Information related to High-Risk personnel or other distinguished personnel.

2) U.S. Capabilities.

3) Meetings of government officials or large groups of government personnel.

4) Information concerning government facilities and capabilities.

CUI 12

d. (CUI) Extremist Groups. Extremist groups will use or disclose potentially critical sensitive information to advance their cause in the media.

e. (CUI) Criminals. Criminals will collect open-source information and any information they can obtain from insiders of the unit or organizations they target.

f. (CUI) Hackers. Hackers are motivated by ideology, criminal intent, revenge, and thrill- seeking and have the skills to penetrate through sophisticated defenses to obtain information on computer systems and networks. Hackers are difficult to identify as they can remain anonymous through the Internet. Critical and sensitive information on publicly accessible websites are targets for hackers.

8. (U) OPSEC MEASURES: OPSEC measures are actions taken to protect ACC-DTA’s critical information from inadvertent release. The following OPSEC measures will be integrated with day-to-day activities and planning for future operations:

a. OPSEC Review Certification Form STA 7114 will be used to document OPSEC reviews and information that has been approved for public release (see graphic below for examples of inappropriate information for public release). The requester will route the document through their organization to include a supervisor and technology reviewer and through security, legal and PAO. A copy of the form will be maintained by the organization’s security proponent and the organization that generated the briefing, paper, video, photograph, or product for public release for a minimum of 24 months. See Annex C.

b. The contract requirements package, Antiterrorism/Operations/Information

CUI 13

Assurance/Information Security Review/Cover Sheet STA Form 255 will be used within ACC-DTA. Organizations that are not subordinate to ACC-DTA are encouraged to use STA Form 255 instead of the DA Contract Requirement Package Antiterrorism Security Review Cover Sheet. See Annex D.

c. Understand the threats we face. Particularly those with overt and clandestine hostile intelligence collecting methods.

d. Annual security training to include OPSEC is mandatory for all ACC-DTA military, civilian, and contractor personnel. Documented in TED.

e. Personal cameras, cell phones, tablets, computers, music devices, radios, USB drives, and recording equipment are not permitted in areas where classified information is processed. Personal cameras to include those on cellular devices are never permitted for use on the Detroit Arsenal (exemption is possessing a camera pass).

f. White boards in conference rooms and at desks will be protected from casual observation and cleared at the close of business. Charts, graphs, models, equipment parts, etc., must be given appropriate level of protection to prevent theft and/or unauthorized disclosure.

g. Suspicious vehicles parked or people loitering near buildings/installation perimeter will be immediately reported to the local first responders and ACC-DTA Security.

h. Specific OPSEC measures must be developed for off-site meetings, conferences, etc. This will be coordinated through ACC-DTA Security.

i. Avoid posting of schedules openly which reveal when sensitive events will occur.

j. Control access to reports related to the disposition of the organization’s personnel.

k. Limit distribution on rosters that identify personnel by position, military occupation specialty/area of responsibility, grade, and/or security clearance.

l. Do not discuss assignments, duties, or reason for travel unless necessary (e.g., with security, customs, or immigration personnel).

m. Addresses will be removed from mail envelopes/packages (official and personal) prior to disposal.

n. When secure telephones are used in areas conducting sensitive and classified operations, the user must be aware of the surrounding environment

CUI 14

and personnel present. Even though all people in a secure area may be approved for classified access, they may not have a need-to-know.

o. CUI, legacy FOUO, and privacy act protected information must be CAC encrypted when sent over the NIPRNET/internet. Individuals have been instructed not to leave their CAC unattended (outside of visual contact) and unsecured (no more than an arm's length away). All CACs or Secret Internet Protocol Router Network (SIPRNet) token cards must be removed from any workstation when not in use. The Network Enterprise Center (NEC} conducts scans of the installation network for unauthorized software, hardware and suspect websites are filtered. Do not plug any unapproved devices or wireless devices into any government equipment.

p. Safe combination changes will be recorded on a safe combination sheet (SF 700), and combinations will be changed when the combination has been compromised, or when personnel who had knowledge of the combination are reassigned or no longer require that access, whichever comes first.

q. All classified, CUI or program critical technology and technical information, regardless of its medium, including drafts, must be reviewed, and marked by the author to ensure proper security/classification markings are applied throughout the document and the correct limited dissemination or distribution statement is posted on the first page. CUI and legacy FOUO level information shall be secured in locked desks, cabinets, or rooms when not in use.

r. CUI or personally identifiable information (PII) coversheets are placed on top and at the back of CUI materials and access is limited to those individuals with a lawful government purpose when they are in use. If an Unauthorized Disclosure (UD) of CUI or sensitive program information is suspected, this must be reported to a supervisor or security manager.

s. An SF 701 (End of Day Checklist) is placed near the organization's primary exit and is reviewed/signed anytime there is activity in an area with restricted access or classified storage containers. This form is unique to each area and must be maintained for 90 days if there was no security violation and for one year if there was. Each day of the month must be accounted for on the SF 701, to include weekends, holidays, and dates when there is no activity in the area. An SF 702 (Security Container Check Sheet) will be utilized for every active classified storage container. A new form will be maintained for each month the container is in use. The form will be annotated to reflect the room number, building number, container number, month, and year at the top of the form. Notations will be made on the SF 702 if the containers are opened during non-duty hours, on weekends, on holidays and whenever there is activity in the work area. All days in the month will be accounted for on the SF 702 regardless of whether checks were made during non-duty hours or holidays IAW AR 380-5.

CUI 15

t. Reproduction equipment showing the highest classification level that may be reproduced on it with administrative and procedural information concerning the use of the copier. Owners of equipment must identify/designate which reproduction/copying equipment in their respective organizations are authorized to reproduce unclassified and classified information and at what level. CUI documents must be destroyed via use of cross-cut shredders or the Shred-It bins.

u. Security access for all personnel assigned to ACC-DTA and tenant organizations must be verified through the authorized system of record, the Defense Information System for Security (DISS). All departing personnel (military, civilian or contractor) must contact ACC-DTA Security to ensure their access is terminated and that they have received any required debriefings.

v. Each ACC-DTA building is surrounded by a perimeter fence and DoD civilian police patrol control access. Vehicles entering any facility may be subject to random searches. Personnel assigned to ACC-DTA are issued a CAC which they must present to the guard at the gated entrance to gain access to the installation. Video cameras are in place to allow central monitoring of activities. In addition, restricted buildings, sensitive and classified locations have secondary controls and are alarmed.

w. Individuals who have been issued a SIPRNet token will receive online derivative classification training annually via Center for Development of Security Excellence (CDSE) and provide a copy of the training certificate to ACC-DTA Security.

x. An OPSEC compromise is the disclosure of sensitive and/or critical information that jeopardizes a unit's ability to execute its mission or to adequately protect its personnel and/or equipment or affects national security.

For sensitive and/or critical information that has been compromised and is available in open sources, the public domain should not be highlighted or referenced publicly outside of intra-governmental or authorized official communications as these actions provide further unnecessary exposure of the compromised information. Personnel should not respond to queries to deny or confirm the validity of sensitive information that has been compromised or released to the public. Notify ACC-DTA security manager of all OPSEC compromises.

y. An OPSEC violation occurs when there is a known disclosure of sensitive and/or critical information that has already been identified in our CIL. An OPSEC violation is punishable by the Uniform Code of Military Justice or disciplinary action for civilians.

CUI 16

CUI 17

ANNEX A: CRITICAL INFORMATION LIST (CIL) AND ESSENTIAL ELEMENTS OF

FRIENDLY INFORMATION (EEFI)

Note: ACC-DTA subordinate sites utilizes the critical information written in the TACOM CIL/OPSEC plan and/or the INSCOM CIL/OPSEC plan. ACC-DTA Security has copies.

1. CRITICAL INFORMATION LIST. Listed below is the critical information list specific to ACC-DTA requiring protection from adversaries:

a. Procurement sensitive information which includes, but is not limited to, contractor bid or proposal information and source selection. ACC-DTA personnel must protect this information in accordance with (IAW) FAR 14.40,1 Receipt and Safeguarding of Bids;

FAR 15.207, Handling Proposals and Information; applicable law; and agency regulations. No person or other entity may disclose contractor bid or proposal information or source selection information to any person or other entity other than a person authorized to receive the information.

b. Details on protection methodologies of ACC-DTA and Army personnel, property, CUI, and FOUO and classified documents, to include: physical and digital security protocols (lock and key program, cipher lock and safe combinations, barrier plans, access control, encryption, and other OPSEC measures.

c. Capabilities, limitations, and vulnerabilities of equipment, mission-specific software systems (e.g. virtual contracting enterprise, paperless contracting files, SharePoint enterprise portal), and Protection Programs (Physical Security, Antiterrorism, OPSEC, Contingency Operations). Details of plans or operations:

exercise orders, operation plans, operation orders, and/or contingency orders.

d. Specifics of exercises, operations, participating or projected forces, unit or projected unit locations, or organization readiness levels.

e. Planned future operations detailing participating U.S. or allied units, their locations (current or proposed), equipment, manning, procurement, supply, and readiness levels.

f. Movement information of key command personnel which includes, but is not limited to, itineraries, meeting agendas, reservations, and travel routes.

g. Personally Identifiable Information (PII).

h. Any information that would reveal force structure and readiness.

i. Force protection, movement and readiness data, tactics, techniques, and procedures (TTPs), proprietary information and information protected by copyright, pre-decisional documents and draft publications.

j. Details on personnel travel (TDY) and deployments.

CUI 18

2. ESSENTIAL ELEMENTS OF FRIENDLY INFORMATION (EEFI)

a. PURPOSE. Based on the CIL, EEFI are key questions likely to be asked by adversaries about specific friendly intentions, capabilities, and activities. Therefore, exposure could diminish or halt operations or actions; compromise classified or critical or sensitive but unclassified information; and provide adversaries with information allowing technological, tactical, operational, and/or strategic advantage. Think like “the wolf” and remember to protect each “puzzle piece”- preventing an adversary from seeing the “big picture”.

1) Which contractors are bidding on XXX proposal/source selection?

2) How do you protect classified documents?

3) What is the capability, limitation, and/or vulnerability of equipment XXX and/or system XXX?

4) Do you have protection or operation plans? How do you exercise them? When?

5) The contract you’re working on, is it for a planned or future operation? Where is the equipment/service/supply being delivered to?

6) Where do employees travel and why?

7) How is employee personally identifiable information (PII) safeguarded?

8) How many employees are deployed? Where? For how long?

9) What is the equipment/personnel readiness status for ACC-DTA?

10) What physical security vulnerabilities exist in your organization?

11) What ae the performance, capabilities, limitations, and vulnerabilities of equipment, mission-specific software systems (contracting writing systems, etc.).

CUI 19

ANNEX B: CONTROLLED UNCLASSIFIED INFORMATION (CUI)

Certain types of unclassified information also require application of access and distribution controls and protective measures for a variety of reasons. Such information is referred to collectively as CUI. There are multiple categories of data that fall under the designation of CUI. These are:

• Critical Infrastructure • Defense • Export Control • Financial • Immigration • Intelligence • International Agreements • Law Enforcement • Legal • Natural and Cultural Resources • NATO • Nuclear • Patent • Privacy • Procurement & Acquisition • Proprietary Business Information • Statistical • Tax • Transportation

For a complete listing of CUI Categories, refer to the CUI Registry at archives.gov/cui.

Examples:

• Contractor bid or proposal information

• Technical data marked as proprietary by a contractor

• Name, address, and phone numbers of the offeror

• Source Selection

• Intelligence Contracts

• Research and Technology Contracts

• Information about a particular system or service that is not already known (example buying a widget for the Abrams is not CUI, but an unknown part for a new vehicle that hasn’t been announced is).

Context is important as not all contract items are CUI. Ask these questions before deciding whether something should be marked CUI.

• Is the information part of ACC-DTA’s Critical Information List?

• Is the information public knowledge or widely known? If the information is already known (via a previous public release, an older weapons system or contract, etc. then information is probably not CUI.

• Is the overall level of detail correct and necessary? Consider redaction of parts of the documents/contracts to conceal CUI before public release.

• Is the information needed by an adversary to kill, counter, or close a program or system? Think like the wolf. What could the ‘bad guy’ do with the information.

• Did the requirements office already sign off/OPSEC review on the information’s release?

Prior to releasing information to the public, an OPSEC review must be completed. See Annex C.

CUI 20

CUI 21

CUI Categories: https://www.archives.gov/cui/registry/category-list

Controlled Unclassified Information (CUI) Program (archives.gov) information on marking, protecting, and reproduction of CUI.

https://www.dodcui.mil for more information.

https://www.archives.gov/cui/registry/category-list https://www.archives.gov/files/cui/documents/cui-overview-powerpoint.pdf https://www.dodcui.mil/

CUI 22

MARKING CUI DOCUMENTS

SEE GUIDE FOR ALL DOCUMENT TYPES:

https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA- BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSe curity%2FInformation%20Security%20%28INFOSEC%29%2FDoD%20CUI%20Marking %20Aid%2020200915%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecu rity%2FInformation%20Security%20%28INFOSEC%29 https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FInformation%20Security%20%28INFOSEC%29%2FDoD%20CUI%20Marking%20Aid%2020200915%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FInformation%20Security%20%28INFOSEC%29 https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FInformation%20Security%20%28INFOSEC%29%2FDoD%20CUI%20Marking%20Aid%2020200915%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FInformation%20Security%20%28INFOSEC%29 https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FInformation%20Security%20%28INFOSEC%29%2FDoD%20CUI%20Marking%20Aid%2020200915%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FInformation%20Security%20%28INFOSEC%29 https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FInformation%20Security%20%28INFOSEC%29%2FDoD%20CUI%20Marking%20Aid%2020200915%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FInformation%20Security%20%28INFOSEC%29 https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FInformation%20Security%20%28INFOSEC%29%2FDoD%20CUI%20Marking%20Aid%2020200915%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FInformation%20Security%20%28INFOSEC%29

CUI 23

ANNEX C: OPSEC REVIEW PROCESS

An OPSEC Review is intended to evaluate a document or other type of information and/or media designated for unclassified and unlimited (public domain) distribution.

The purpose of an OPSEC Review is to help ensure the protection of information, which may be sensitive or critical information (AR 530-1.)

When information or material is received by ACC-DTA Security containing information which may prove beneficial to an adversary, notification by the ACC- DTA Security reviewer along with his/her recommendations will be provided back to the author for modification. NOTE: ACC-DTA Security will only OPSEC review items that ACC-DTA “owns” or is the “originator”. All other items, i.e., a contract action usually originates from a requiring activity, and therefore, their security POCs would conduct the OPSEC review.

The STA 7114 must be used when you plan on making your product (e.g., documents, video tapes, voice tape, briefings, articles, or equipment) available to the general public (Distribution Statement A - Approved for Public Release; distribution unlimited). All documents and/or materials are to be submitted (digital with encryption) through OPSEC Review channels (SME/technical review, supervisory, contracting officer, legal, security/OPSEC officer, and public affairs) and must be accompanied by a properly completed, STA Form 7114 "OPSEC Review Certification" to include:

a) Specific name(s) of individuals responsible for authoring the document.

b) Name, signature, grade, and office symbol of a SME/technical reviewer

(management individual who possesses technical expertise regarding the subject matter,) and a supervisor, both of whom must be someone other than the author.

c) A "Purpose of Release and Date of Proposed Release" to provide justification for making the information open source and the benefit in doing so.

d) Items submitted for OPSEC Review (if applicable to ACC-DTA), should be forwarded

(encrypted) electronically to ACC-DTA Security.

e) Originators of items requiring an OPSEC Review should allow for a week planning cycle from submission to finish. This includes receiving legal concurrence, public affairs (if applicable), etc. Note: public affairs are only in the process if the item is to be viewed in the media, in an article, symposium, etc. This ensures conformity and proper aesthetics.

f) Blank 7114: https://acc.aep.army.mil/sites/acc-dta/ERC/Pages/OPSECtpp.aspx https://acc.aep.army.mil/sites/acc-dta/ERC/Pages/OPSECtpp.aspx

CUI 24

Note: Please have Steps 1 through 5 (if applicable) prior to sending to ACC-DTA Security. Step 3 is if you are contractor. Step 4 and 5 is if this for a contract. Step 7 is only necessary when the item is going to be seen as part of a conference, news release, etc. See the below flow chart.

CUI 25

OPSEC is vital because it safeguards the small, seemingly innocuous pieces of information—like puzzle pieces—that adversaries could piece together to reveal sensitive details, potentially leading to serious security breaches or operational failures. By implementing countermeasures such as OPSEC reviews, organizations can identify and mitigate vulnerabilities, prevent inadvertent disclosures, and ensure that critical information remains protected, thereby maintaining operational integrity and national security.

ACC-DTA OPSEC REVIEW PROCESS

*Note: When ACC-DTA is NOT the requiring office please defer to your customer. Most organizations have a trained and appointed OPSEC officer. For ACC-DTA actions (we are procuring the item or service, we are giving the briefing (industry engagements), etc .)

2) Author submits product & STA 7114 to Tech

Reviewer/SME (if applicable)

3) Originator sends to Supervisor for approval.

5) Originator sends to ACC-DTA Security for OPSEC Review

7) If upon receipt all have concurred, item is released.

8) If all have not concurred, item is returned to author to make directed changes.

1) Individual is tasked to prepare a product for public release. (Briefing, tri-fold, PowerPoint, article, report, etc.).

4) Legal Review (if applicable-contractor information, proprietary information, etc.)

6) Public Affairs (if necessary).

9) In completion of changes results in approved release or withdrawal.

CUI 26

ANNEX D: OPSEC IN CONTRACTING (STA 255)

Purpose. In lieu of the DA coversheet (per ALARACT 015/2012), local agencies to include TACOM and those that support TACOM will utilize the STA Form 255.

The purpose of the form is to document the review of the requirements package, statement of work (SOW), quality assurance surveillance plan and any applicable source selection evaluation criteria for antiterrorism (AT) and other related protection matters to include, but not limited to: AT, operations security (OPSEC), information assurance (IA)/cyber security, physical security, law enforcement, intelligence, foreign disclosure. Other agencies and organizations (i.e., local Garrisons, PEOs, etc.) are allowed to utilize the standard DA coversheet.

The contracting officer will ensure that contractor personnel are appropriately certified and provide verification to the Defense Manpower Data Center (DMDC) database: https://dwp.dmdc.osd.mil/dwp/app/main . Additional training on local or system procedures may be provided by the DoD organization receiving services.

Additional Information: https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA- BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2F Security%2FAntiterrorism%20%2DForce%20Protection%2FAT%20OPSEC%20guide %5FFourth%20Edition%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2 FSecurity%2FAntiterrorism%20%2DForce%20Protection

TPP: https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA- CTools/SitePages/TPP%20and%20SOP/ATOPSEC.aspx https://dwp.dmdc.osd.mil/dwp/app/main https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FAntiterrorism%20%2DForce%20Protection%2FAT%20OPSEC%20guide%5FFourth%20Edition%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FAntiterrorism%20%2DForce%20Protection https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FAntiterrorism%20%2DForce%20Protection%2FAT%20OPSEC%20guide%5FFourth%20Edition%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FAntiterrorism%20%2DForce%20Protection https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FAntiterrorism%20%2DForce%20Protection%2FAT%20OPSEC%20guide%5FFourth%20Edition%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FAntiterrorism%20%2DForce%20Protection https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FAntiterrorism%20%2DForce%20Protection%2FAT%20OPSEC%20guide%5FFourth%20Edition%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FAntiterrorism%20%2DForce%20Protection https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-BMD/Security/Forms/AllItems.aspx?id=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FAntiterrorism%20%2DForce%20Protection%2FAT%20OPSEC%20guide%5FFourth%20Edition%2Epdf&parent=%2Fsites%2FHQACC%2DDTA%2DBMD%2FSecurity%2FAntiterrorism%20%2DForce%20Protection https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-CTools/SitePages/TPP%20and%20SOP/ATOPSEC.aspx https://armyeitaas.sharepoint-mil.us/sites/HQACC-DTA-CTools/SitePages/TPP%20and%20SOP/ATOPSEC.aspx

CUI 27

The STA 255

CUI 28

ANNEX E: DOCUMENT DESTRUCTION AND DISPOSAL

RECYCLE BINS (AKA “THE BLUE BINS”)

Environmental considerations: If an unacceptable item is thrown in the bin, all contents of the bin are put in a landfill. Please place CLEAN items in bin. Break down cardboard and place behind the bin.

ACCEPTABLE ITEMS:

Not Acceptable:

Styrofoam Garbage Colored Glass Chemicals Paint Cans Medical Waste Flammable Liquids Government Phone Books

NO SENSITIVE INFORMATION (SEE

NEXT PAGE)

NO CLASSIFIED INFORMATION

SHRED-IT BINS

APPROVED FOR SENSITIVE DOCUMENTS:

Controlled unclassified information (CUI), For Official Use Only (FOUO), Operations Security (OPSEC), and Personally Identifiable Information (PII).

Examples:

• Items protected by the Privacy Act/things consideredPII: print out of an emailwith signature blocks, personnel files, appraisals, emergency rosters

• Procurement sensitive information: contractorbid or proposal information, source selection

• OPSEC sensitive: test locations and dates, internal installation maps, detailed budget data, standard operating procedures, detailed organization charts (with phone and email listings), information extracted from an intranet website (ourportal)

• Anything specifically markedFOUO or Close Hold

NOT APPROVED FOR:

• Any personal papers or documents

• Household shredding items

• Classified Information

Note: If a Shred-It bin appears to be full, please use another bin. You can test to see if a bin is full by being able to grab documents from the opening. If you find overflow documents, report this to your division security coordinator or ACC-WRN Protection immediately.

CUI 29

ANNEX F: OPSEC FOR THE FAMILY

Although the graphic below is tailored for miltiary families, the same concepts applies for DACs. We must understand that the ‘the bad guys’ can utilize our family members to find out about what you do.

CUI 30

CUI 31

OPSEC FOR SOCIAL MEDIA

OPSEC Don’ts

• Don’t discuss work on social media

• Don’t use the same passwords for multiple sites

• Don’t use unsecured logon within public spaces

• Don’t expect or depend on social media sites to offer security or protect your privacy

• Don’t trust Add-ons

• Don’t be too generous with permissions

• Don’t post information that isn’t already available to the public

• Do not use “check-in” location features (disable them).

OPSEC Dos

• Question the utility of using social media (risks vs. benefits)

• Do not post personal identifiable information on social media

• Remember to practice computer security

• Before posting information to a social media site consider who might have access to the data

• Modify personal search profile (the data visible to others)

• Maintain reasonable suspicion about people you don’t know

• Watch your “friends” on social media who may post sensitive information about you or your family

• Be careful about accessing links and files on social media

• Verify supposed “real” friends

Addendum 1:

THE PROCEEDING PAGES ASSIST WITH THE OPSEC REVIEW PROCESS AND

GENERAL OPSEC CONSIDERATIONS.

SOURCE: NEW EMPLOYEE SECURITY IN-BRIEF.

UNCLASSIFIED

WHAT IS OPSEC?

• “Operations Security”.

• OPSEC is used to deny our adversaries UNCLASSIFIED CRITICAL and SENSITIVE information about our organization’s Capabilities, Activities, Limitations and Intentions (CALI), that can be used against ACC-DTA and our friendly forces

• OPSEC is a mindset that all of us must develop to protect our mission, personnel, and resources.

• It is a PROCESS! that protects Controlled Unclassified Information.

“The general is skillful in attack whose opponent does not know what to defend; and he is skillful in defense whose opponent does not know what to attack” -Sun Tzu, 200 B.C.

OPSEC process

OPSEC is a 5 step process that identifies critical information to determine if friendly actions can be observed by adversary intelligence systems, determines if information obtained by adversaries could be interpreted to be useful to them, and then executes selected measures that eliminate or reduce adversary exploitation of friendly critical information. It is a methodology that denies critical information to an adversary.

Step 1: Identify Critical Information

Information that is essential for the success of a mission.

Step 3: Analyzing Vulnerabilities A vulnerability exists whenever an adversary can collect an indicator that points to critical information about a mission.

Step 4: Assessment of Risk Is the decision-making step, once a vulnerability has been detected, to determine if countermeasures should be applied.

Step 2: Analyze the threats.

Threats to the success of a mission are caused by adversaries.

Step 5: Apply Countermeasures Anything that effectively negates or reduces an adversary’s ability to exploit your vulnerabilities

CRITICAL INFORMATION

The Critical Information List (CIL) includes specific facts about friendly intentions, capabilities, and activities needed by adversaries to plan and act effectively against friendly mission accomplishment.

THE THREAT(S)

Domestic Threats: The information they and seek to obtain is readily available as open source and unclassified information.

Criminals: They collect open source, unclassified information that is publicly available.

They may also obtain information through other means such as money or coercion from unit insiders or the organization they target.

Hackers: Critical and sensitive information on publicly accessible Internet websites are easy targets for hackers and must not be posted on unclassified, unprotected computers and networks.

Insiders: They are very difficult to identify when they can keep their collection activities unnoticed. For these reasons, sensitive and critical information should only be shared with personnel who need to know.

ANALYSIS OF VULNERABILITIES

Vulnerabilities are the ways we inadvertently provide our adversaries access to the very information we should be protecting.

We post too much sensitive information on web pages and blogs. We send e-mails with detailed attachments, such as maps, drawings or pictures, without encryption. We publically release official information without an OPSEC Review.

We innocently share too much information with people who do not need to know.

How often have you answered the phone, and provided more information than the caller needed? “No, I’m sorry Joe isn’t here. He is vacationing in Bermuda with his family for the next two weeks. May I take a message?”

COUNTERMEASURES

OPSEC at Work

• Protect your CAC while on the installation, conceal when off post.

• Challenge all who are not displaying their installation badge.

• Adhere to webpage policies and information assurance (IA) rules.

• Shred or tear all CUI documents to make them unreadable when no longer needed.

• When sending CUI or PII information, use CAC encryption.

• Do not leave your CAC, or computer in your car, hotel, or at your desk unattended.

• Follow security training and seek assistance from ACC-DTA Protection

• OPSEC reviews on documents

OPSEC at Home

•…