Sample Contractor OPSEC PLAN Template UPDATED MARKINGS.doc

CUI

Norfolk Naval Shipyard (NNSY) DD254 OPSEC PLAN

TITLE OF PROGRAM

INSERT COMPANY NAME

OPERATIONS SECURITY (OPSEC) PLAN DD254 ATTACHMENT

Contract No.

XXXXX

Date:

XXXXX

Prepared by:

Approved by: ______________________

Typed Name / Signature

Typed Name / Signature

Title

Title Prepared for:

Submitted by:

COMMANDER,

INSERT CONTRACTORS ADDRESS

NORFOLK NAVAL SHIPYARD

Norfolk Naval Shipyard

Portsmouth, VA 23709

Distribution Statement D: Distribution authorized to Department of Defense and DoD US contractors only for Operations Security; (INSERT DATE). Other requests shall be referred to Code 1122/Industrial Security.

Warning: This document may contain technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751 et seq.) or Executive Order 12470. Violation of these export laws is subject to severe criminal penalties. CUI - The information contained in this document and any accompanying attachments may contain information which is protected from mandatory disclosure under the Freedom of Information Act (FOIA), 5 U.S.C. 552.

Controlled by: COMPANY NAME HERE Controlled by: XXXXXX CUI Category: OPSEC Distribution/Dissemination Control: FEDCON

POC: First, Last, Email, (757) XXX-XXXX Table of Contents

1 Purpose

2 Policy 3 Applicability

4 Responsibilities 5 OPSEC Plan POCs 6 OPSEC Process 7 Education and Awareness 8 OPSEC Analysis 9 OPSEC Countermeasure Matrix Purpose

This document establishes an intelligence-informed protective and cost effective for Operations Security (OPSEC) Plan for NNSY contracts and sub-contracts when imposed by marking “Yes” in Section 11j on the DoD Contract Security Classification Specification DD Form 254.

Policy

The five step OPSEC analytical process should be integrated with every phase of this contract including technical tasking, program management, and contract administration. All contractor and relevant subcontractor employees should participate in this OPSEC Plan and ensure Critical Information (CI) as well as classified information are protected. This Plan is also consistent with guidance in the SECPROMAN VOL 1, 5510.36 Rev E, dated 23 January 2020.

Applicability This OPSEC Plan applies to all solicitations and awarded contracts by consultants, and sub-contractors under this contract, sub contract, project and task when imposed by the DD Form 254. All applicable personnel will review this document and become familiar with not only the guidance detailed in this plan but also the OPSEC process employed to develop these concepts. Adherence to this OPSEC Plan will be the responsibility of the Facility Security Officer (FSO) and the Program Manager. OPSEC will also apply to the activities of any sub-contractor and international subcontractors receive OPSEC guidance with an approved DD Form 254, as applicable.

Responsibilities Adherence to this OPSEC Plan is the responsibility of contractor personnel working under a NNSY contract. All personnel are responsible for the successful implementation of this plan. The FSO will coordinate the implementation of training, administration, and execution of this plan with government officials. The FSO will also ensure that all procedures identified in this Plan are followed. NNSY Security (C1120) will support the FSO in the development, implementation, and compliance with the procedures established in this OPSEC Plan.

5 OPSEC Plan Points of Contact (POCs) The below lists the OPSEC Plan (POCs) responsible for ensuring the execution of the OPSEC process and the subsequent identification/protection of CI. In addition, the POCs will also make recommendations to the Program Manager in order to implement intelligence-informed protective and cost effective risk-management OPSEC solutions

Name: ________________________________

Title: _________________________________

Phone: ________________________________

Email: ________________________________ Name: ________________________________

Title: _________________________________

Phone: ________________________________

Email: ________________________________ OPSEC Process OPSEC is a systematic and proven process by which NNSY and its supporting contractors can deny potential adversaries information about Capabilities, Activities, Limitations and Intentions (CALI) by identifying, controlling, and protecting generally unclassified evidence of the planning and execution of sensitive NNSY activities. The OPSEC process is most effective when fully integrated into all planning and operational processes. The OPSEC process involves five steps:

1. Identification of Critical Information (CI)

2. Threat characterization

3. Analysis of vulnerabilities

4. Assessment of risk

5. Application of appropriate countermeasures.

Generally unclassified evidence of CALI includes otherwise unprotected computer science networking; technology development; technology application(s); and research, development, test, and evaluation (RDT&E) thrusts. NNSY’s CI includes but is not limited to information regarding:

1. Operations, missions, and exercises;

2. Test schedule or specific test location;

3. Off-base movement of classified or sensitive information or arms, ammunition, and explosives (AA&E);

4. Location of sensitive equipment (AA&E, COMSEC, etc.) or sensitive facilities (e.g., restricted areas or laboratories);

5. Force structure and readiness, such as recall rosters;

6. Capabilities, vulnerabilities, and limitations;

7. Security weaknesses;

8. Existence and/or details of intrusions into or attacks against NNSY networks or information systems;

9. Network (and system) user IDs and passwords;

10. Movements of key command personnel or visiting dignitaries, including itineraries, meeting agendas, hotel and transportation reservations, plans/routes, etc.; and

11. Security classification of equipment, systems, operations, etc.

6.1 Hostile Threat The threat to NNSY activities is ongoing. Although there may be no eminent identified threat, exploited CI negatively impacts our success. NNSY CI is subject to collection efforts by adversaries, who employ both overt and covert methods. The four intelligence collection methods listed below most utilized to gather NNSY CI are:

6.1.1 Human Intelligence (HUMINT) Threat

The collection of information through the use of human sources. It is gathered either covertly by espionage agents with placement and access or overtly through information available in the public domain. A high priority is assigned to the acquisition of scientific and technical information concerning the research and development of NNSY military technology and industrial techniques and processes, and related military and strategic capabilities. This information is collected primarily to anticipate military application of technological breakthroughs and to foster scientific, mechanical, and industrial support of the collector's strategic force. HUMINT threats include:

a) Espionage Agents – Intelligence agents are assigned and tasked to target DoD contractor personnel, particularly RDT&E efforts. The individual intelligence agents will use people in an attempt to develop any information they can use.

b) Foreign Visitors – The presence of foreign visitors, either in an official status or as the casual tourist, increase the risk of intelligence collection efforts.

6.1.2 Open Source Intelligence (OSINT) Threat

Foreign intelligence collection services satisfy the majority of their intelligence collection requirements through the systematic analysis of open source literature. Such information may be obtained through the news media, official and unofficial organization and professional publications, the World Wide Web (WWW), the National Technical Information Center (NTIC), the Defense Technical Information Center (DTIC), at meetings and seminars, or through contractor advertisements. These sources provide our adversaries with highly valuable information regarding military CALI. To put the open source threat into the proper context, consider that the total number of dedicated foreign agents in this country is estimated to be between one and two thousand, while the total number of reporters in this country is closer to one million; a thousand to one ratio. HUMINT organizations depend heavily on OSINT to assist them and are much more likely to learn of CALI through open sources. It has been estimated that 90% of the needed information is available through open sources.

The Navy Web Risk Assessment Cell (NWRAC) http://www.nioc-norfolk.navy.mil is available to review websites for OPSEC vulnerabilities.

6.1.3 Signals Intelligence (SIGINT) Threat

This collection method includes communications intelligence (COMINT), electronic intelligence (ELINT), and telemetry intelligence (TELINT) or foreign instrumentation signal intelligence. This threat targets telephones (including cellular, pagers, and residential), radio transmissions, and facsimile transmissions. Exploitation is much easier when any deviation from standard security practices occurs. The most common error is discussion of CALI information over a non-secure telephone or transmitted via non-secure facsimile. Intelligence personnel with mobile collection equipment sometimes perform signal collection efforts within close proximity to government and contractor facilities and test ranges. Foreign SIGINT collectors that pose a threat include:

a) Fixed ground collection stations, including several embassies and embassy-related facilities.

b) Space-borne SIGINT platforms capable of intercept of radio frequency emitters.

c) Ocean-going vessels specifically designed for intelligence gathering known as Auxiliary General Intelligence (AGI).

d) Merchant ships.

e) Telephonic communication, including voice, facsimile and "dial-up" computer access. Intercept of telephone microwave links is possible by anyone with the appropriate, available (off-the-shelf) equipment.

6.1.4 Imagery Intelligence (IMINT) Threat

Imagery intelligence (IMINT) can be collected through the use of cameras and imaging devices mounted in airplanes, ships, space vehicles, or carried by individuals on land. The collection plan may call for the imagery collected by individuals to be analyzed by both HUMINT and IMINT disciplines, while images from all other collectors are analyzed through the IMINT discipline. IMINT can provide the adversary with an extremely valuable collection and analysis tool, especially during the testing and evaluation stages of system development. IMINT threats against the U.S. are:

a) Satellites

b) Manned space laboratories

c) Commercial and private aircraft

d) Imagery obtained from boats and ships

e) Field agents 6.2 Vulnerabilities OPSEC vulnerability exists when known or suspected threats are aligned against our weaknesses. The vulnerabilities will require periodic updating based on the new threat information and changes in the scope of the project. Determine what an adversary needs to know and where the information is available, it is necessary to determine if it is possible that the adversary could acquire and exploit the information to diminish or preclude our success.

6.3 Risk Assessment Risk Assessment is the process of evaluating the threats and vulnerabilities of a project. Risk assessment is essentially the process of balancing vulnerability against the threat, then deciding if the residual risk warrants application of countermeasures. Included in the assessment of an adversary's capability is not only their ability to collect the information but also their capability to process and exploit (evaluate, analyze, interpret) the vulnerability in time to make use of the information.

6.4 Countermeasures

A countermeasure is anything that effectively negates an adversary's ability to exploit vulnerabilities. The most effective countermeasures are simple, straightforward, procedural adjustments that effectively eliminate or minimize the generation of indicators.

All CI developed by the contractor and /or NNSY, in electronic or hardcopy form must be protected by a minimum of the following countermeasures:

a) All emails containing CI must be DoD Public Key Infrastructure (PKI) signed and PKI

Encrypted when sent

b) CI may not be sent via unclassified fax

c) CI may not be discussed via non-secure phones

d) CI may not be provided to individuals that do not have a need to know it in order to complete their assigned duties

e) CI May not be disposed of in recycle bins or trash containers

f) CI may not be left unattended in uncontrolled areas

g) CI in general should be treated with the same care as CUI-FOUO or Proprietary information

h) CI must be destroyed by burning or shredding

i) CI must be destroyed at contract termination or returned to the government at the government’s discretion

Education and Awareness It is the responsibility of the FSO and Program Manager to ensure that all personnel assigned to work under NNSY contracts have received the appropriate security and OPSEC briefings.

7.1 OPSEC training should be provided annually and included as part of the contractor’s ongoing security awareness program. NNSY will provide computer based training to all its employees and seated contractors. This training can be accessed via the web, or computer based via (Navy Knowledge Online). If preferred, a copy of the training CD can also be provided free of charge by sending an email request to the NNSY OPSEC POC.

8 OPSEC Analysis

8.1 The contractor should document items of CI that are applicable to contractor operations involving information on or related to the State of Work (SOW).

8.2 Such determinations of CI should be completed using the DoD OPSEC 5 step process as described in National Security Decision Directive (NSDD) 298 and DoD 5205.02E.

8.3 The contractor will not disclose classified or sensitive unclassified information pertaining to a classified contract to the public without prior review and approval by NNSY Security (C1120).

8.4 If the contractor cannot resolve an issue concerning OPSEC, they can contact the NNSY OPSEC Program Manager, Ms. Teresa Coon @ 757-396-4928.

8.5 All above requirements should be passed to all sub-contractors.

8.6 Analysis of Threats Although there are no specific eminent threats to NNSY, there is a general threat against all Department of Defense (DoD) activities, especially in HUMINT, SIGINT, and IMINT capabilities that must be taken into account in contract performance.

8.7 Analysis of Vulnerabilities

8.7.1 A specific vulnerability for NNSY or CI contract performance is an unintended distribution of FOUO materials. A use of the NIPRNET and Internet as its main means of information sharing creates a vulnerability. Email could be intercepted or an on-line meeting monitored in which FOUO or CI information is contained and/or discussed.

8.72 To ensure protection of sensitive materials, employees shall never place emails, Personally Identifiable Information or controlled unclassified documents into recycling receptacles or trash bins unless they have been properly shredded by a high security cross cut shredder.

8.73 Always verify need-to-know before giving access to CI.

8.8 Assessment of Risk For further OPSEC support, the Enterprise Protection Risk Management (EPRM) provides a consistent and technically sound methodology to identify, analyze, quantify and communicate risk. To request an EPRM account, contact the EPRM Support Team at EPRMhelp@alionscience.com.

This is a sample only. If your contract requires more in depth protection of Critical Information, please make the necessary additions.

OPSEC Countermeasure Matrix

The analysis below highlights general threats and countermeasures to NNSY with applicable good security practices.

Disclosure of Critical Information

1. Use a secure phone for specific CI detail when appropriate. Discuss such information only in appropriate areas.

2. All personnel directly involved will be briefed on their individual responsibilities in accordance with established security classification guidance and/or other appropriate OPSEC guidance for control of sensitive, For Official Use Only CI, or unclassified information. In lieu of a briefing, personnel may review this OPSEC Plan and the appropriate security classification guidance.

3. The transmission of unclassified CI information via unsecured facsimile machines and equipment is authorized providing all applicable security controls are considered.

4. Specific CI will not be posted on or adjacent to the telephones. However, Norfolk Naval Shipyard (NNSY) OPSEC Cue Cards will be posted in contractor personnel on-station work areas. Transmittal of specific CI is not authorized over unencrypted communications.

5. Information generated in performance of the contract will be appropriately screened for categorization as classified or CI in order to protect the information.

6. Conversations and documentation involving CI will be limited to those individuals performing on the contract and supervisor inquiry/discussion.

No connectivity between the classified and unclassified networks.

2.

All CI will be handled using specific user accounts with individual passwords.

3.

CI will be distributed only to users with the appropriate Need-to-Know.

Unclassified

Email 1.

The distribution of email containing CI will be limited to those personnel with a Need-to-Know.

2.

Contractor personnel will use NIPRNET or company provided email accounts only. Email accounts provided by third parties that are stored on non-government, non-company controlled servers are subject to compromise and are strictly forbidden.

2. Compilation of derived CI will contain the appropriate distribution restrictions, special caveats and/or handling instructions in accordance with NISPOM or any other special guidance or directives issued by the project sponsor.

Perform random spot checks of all waste paper, scratch notes, envelopes, post-it notes, personal papers, and similar materials with particular attention to Recycle Bins.

2. NNSY Camera cell policy forbids the use of a these items inside the CIA or other NAVSEA spaces SECPROMAN Vol. 1, chapter 7.

3. Laptops, IPAD and other devices in this category cannot have web cameras and are treated similar to Camera cell phones and shall be vetted through the IAM and Industrial Security Manager for a clearance letter as per the SECPROMAN Vol. 1 Chapter 11.

For More Information, Contact:

NNSY OPSEC Program Manager, Ms. Teresa Coon teresa.coon@navy.mil

(o) (757) 396-4928

(c) (757) 944-0050

CUI