SF33 Attachment C-1 BAFB_PWS Enclosure 4 OPSEC Addendum 20190607.pdf

Enclosure 4: Operations Security Addendum

Operations Security (OPSEC)

References:

National Security Decision Directive (NSDD) 298

DOD 5205.02

DODD 5205.02E

AFI10-701AFGM_2018-01

All contractors, subcontractors, their employees, associates, and consultants who have access to critical information must comply with the DOD and Air Force-sponsored Operations Security (OPSEC) program. The OPSEC Program is directed by NSDD298, DOD Publications, and applicable Air Force guidance.

OPSEC is a systematic means of identifying and protecting information which an adversary could use to their advantage or to our disadvantage. Critical Information (CI) is generally unclassified but can become classified through compilation. This sensitive information has been identified by the organization’s OPSEC program as requiring protection. OPSEC Measures (OM) are control standards with which all personnel must comply in order to protect CI against adversaries.

RESPONSIBILITIES:

The OPSEC Program Coordinators will provide OPSEC training curriculum for use by the contractor. Critical Information and Indicator Listings (CIILs) must be protected by all contract personnel. Approved organizational OPSEC measures must be used by all contract personnel to protect critical information in their possession and protect against current foreign intelligence and industrial espionage threats. The OPSEC PM/Coordinator and the Lead contractor must ensure all contract personnel working on the contract or having access to CI attend initial and annually recurring refresher training and that the approved curriculum is presented. Training must be provided before contract personnel are allowed access to or handling of critical information. All contract personnel will comply with the organizations OPSEC standards and practices as trained. Additional training may be required based on updates to critical information, OPSEC measures, intelligence threat/vulnerability, or other fundamental changes to the OPSEC program. The OPSEC Coordinator is responsible for contacting the OPSEC Program Manager if OPSEC isn’t written into the contract.

The OPSEC PM/Coordinator for the organizations will track OPSEC training statistics for all personnel working on the contract, when each individual has received the required OPSEC training, and when refresher training is due. Training statistics must be forwarded to the installation OPSEC PM at the end of each calendar quarter and/or upon request.

Contactors with OPSEC requirements within a contract must ensure employees receive OPSEC training as specified within the contract. Accomplishment of training must not exceed 90 days from initial assignment to a contract with OPSEC requirements. Annual training will be accomplished

NLT 30 September of each year. The contractor personnel will not be given access to an organizations CIIL until after training has been completed and documented by the organization OPSEC Coordinator.

Prior to seeking approval through Hill AFB Public Affairs, any information to be released outside of official U.S. Government channels, via any media, must be approved through an OPSEC review by the organization PM/Coordinator. All personnel must promptly report OPSEC related incidents, issues, and concerns to the organization PM/Coordinator, phone number (to be provided) who will then report it to the installation PM, 801-586-8008.

DODD 5205.02E