Attachment_0022,_JPO_JLTV_OPSEC_Plan.pdf

UNCLASSIFIED//FOR OFFICIAL USE ONLY

DEPARTMENT OF THE ARMY

PROGRAM EXECUTIVE OFFICE

COMBAT SUPPORT & COMBAT SERVICE SUPPORT

6501 EAST ELEVEN MILE ROAD

WARREN Ml 48397-5000

SFAE-CSS-JL

MEMORANDUM FOR RECORD

SUBJECT: ( U ) Project Manager, Joint Program Office Joint Light Tactical Vehicles, Operations Security Plan

1. (U) References:

a. (U) Program Executive Officer Combat Support & Combat Service Support (PEO CS &CSS), Operations Security (OPSEC) Program, 27 October 2016.

b. (U) AR 530-1, Operations Security (OPSEC), 26 September 2014.

c. (U) AR 381-12, Threat Awareness and Reporting Program, 4 October 2010.

d. (U) Security Classification Guide (SCG) Joint Program Office Joint Light Tactical

Vehicle (JPO JLTV), 20 July 2014.

2. (U) General. This OPSEC Plan is a supplement to the PEO OPSEC Program.

a. (U//FOUO) Applicability. This JPO JLTV OPSEC Plan is applicable to all personnel (military, civilian, and contractor) working with the JPO JLTV program. It outlines actions to ensure protection of Program Information from an adversary's observation and collection. This plan is appropriately nested and not meant to replace or circumvent the PEO CS&CSS OPSEC Program. OPSEC compliments and reinforces other security program disciplines by eliminating, concealing, or reducing indicators that can compromise critical information. JPO JLTV will implement the principles outlined in this OPSEC Plan in concert with the other security program disciplines.

DISTRIBUTION STATEMENT C: Distribution authorized to the U.S. Government Agencies and their

Contractors; Administrative or Operational Use, 4 Aug 2015. Other requests for this document shall be referred to SFAE-CSS-JL/Security, 6501 E. 11 Mile Rd, MS 640, Warren, Ml 48397-5000, COM (586)239-3491, DSN: 273-3491.

DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

This document contains information exempt from mandatory disclosure under the Freedom of

Information Act.

SUBJECT: Project Manager, Joint Program Office Joint Light Tactical Vehicles, Operations Security Plan

b. (U) JPO JLTV Mission. The JPO JLTV will develop, acquire and field the family of Joint Light Tactical Vehicles, while optimizing the legacy HMMWV fleet, in order to provide capability and flexibility to the Joint War Fighter across the full spectrum of military options for the next 30 years and beyond.

c. (U) Purpose. The purpose of this OPSEC Plan is to control sensitive information and to protect operations and activities that, if exploited, could seriously degrade or defeat current or future plans and activities. To eliminate or mitigate the possibility of exploitation, it is imperative that all personnel are knowledgeable of and apply these procedures during the conduct of their daily mission planning tasks and activities.

3. (U) Responsibilities.

a. (U) Project Manager (PM):

(1) (U) Implement an OPSEC program.

(2) (U) Approve an OPSEC Plan specific to the operation of the Project

Management Office (PMO) as a supplement to the PEO CS&CSS OPSEC Plan.

(3) (U//FOUO) Appoint an OPSEC Officer or Coordinator for the PMO who will perform the requirements of the OPSEC Officer appropriate for the PMO.

(4) (U) Ensure appropriate OPSEC measures are taken within the PMO to preserve essential secrecy.

(5) (U//FOUO) Plan for and implement OPSEC before, during, and after operations or other activities, including research and development testing and evaluation (RDT&E) that affect the combat capability of the U.S. Army. OPSEC will be part of the PM's initial planning guidance.

(6) (U//FOUO) Provide annual reminders of the importance of sound OPSEC practices. These reminders will include OPSEC news releases in publications, OPSEC information bulletins, and OPSEC awareness briefings.

b. (U) OPSEC Officer:

(1) (U//FOUO) Direct and implement the OPSEC program.

(2) (U//FOUO) Plan for and implement OPSEC before, during, and after operations or other activities, including RDT&E that affect the combat capability of the U.S. Army.

(3) (U//FOUO) Chair the JPO JLTV-level OPSEC Working Group to coordinate OPSEC actions across the JPO JLTV on a consistent basis.

Operations Security Plan

(4) (U) In conjunction with other staff officers, develop the JPO JLTV Critical Information List (CIL).

JLTV.

(5) (U) Develop and recommend OPSEC measures to be implemented in JPO

(6) (U) Conduct OPSEC reviews of operational plans and reports to ensure adherence to OPSEC policies and procedures.

(7) (U//FOUO) Conduct OPSEC self-assessment using the published OPSEC guidance to determine whether the PMO is implementing its own OPSEC policies and procedures. The OPSEC Officer will submit a written assessment with results and recommendations to the assessed PM and Program Executive Office (PEO) OPSEC Officer.

(8) (U//FOUO) Ensure that training exercises include realistic OPSEC considerations and that any evaluation of a training exercise includes an evaluation of OPSEC procedures. Further, ensure that pre-exercise briefings include OPSEC, incorporating the threat, CIL, and OPSEC measures.

(9) (U//FOUO) Coordinate with the Public Affairs Officer (PAO) and Freedom of

Information Act Officer to ensure an OPSEC review is conducted before the release of information concerning any programs or projects.

(10) (U) Ensure OPSEC training is conducted in accordance with Reference

1.b. and this OPSEC Plan.

(11) (U//FOUO) Integrate intelligence, counterintelligence, force protection, and Information Operations into OPSEC planning and practice as appropriate.

(12) (U) Monitor the OPSEC programs of subordinate organizations by reviewing OPSEC Plans, survey results, exercise evaluations, and Inspector General Reports.

(13) (U) Conduct an annual OPSEC assessment.

(14) (U) Prepare for PM signature an annual by Fiscal Year OPSEC

Program Status Report to be submitted to the PEO OPSEC Officer.

(15) (U) Perform other duties and responsibilities as defined in Reference 1.b., Appendix H.

c. (U) All personnel:

(1) (U) Implement OPSEC measures as determined by the PM.

Operations Security Plan

(2) (U) Receive Operations Security Level I training

(a) (U) Understand how OPSEC complements traditional security programs to maintain essential secrecy of U.S. military capabilities, intentions, and plans.

(b) (U) Learn how to apply OPSEC to their daily tasks.

(c) (U) Learn why OPSEC is important to the organization.

(d) (U//FOUO) Understand how adversaries aggressively seek information on U.S. military capabilities, intentions, and plans.

(e) (U) Become knowledgeable of the local multidiscipline adversary intelligence threat.

(f) (U//FOUO) Become knowledgeable of JPO JLTV CIL and how to protect it by applying OPSEC measures to prevent inadvertent disclosure.

(3) (U) Maintain need-to-know and telephone security.

(4) (U) Limit distribution.

(5) (U) Avoid talking about work in public locations.

(6) (U) Safeguard unclassified technical data (also known as Controlled Unclassified Information [CUI]).

(7) (U) Be familiar with this OPSEC Plan and where to obtain additional

OPSEC guidance as needed.

(8) (U//FOUO) Handle any attempt by unauthorized personnel to solicit sensitive or critical information per Reference 1.c. Report all facts immediately to the nearest supporting counterintelligence office and inform the chain of command.

4. (U//FOUO) OPSEC Security Considerations. All personnel will consider OPSEC when preparing policies, procedures, and doctrine; designing systems; or prescribing logistic or administrative practices. The OPSEC process applies to all phases of an activity, function, or operation. The five fundamental steps in the OPSEC process are as follows:

a. (U//FOUO) Identification of CIL. Critical information is information associated with

JLTV operations and activities that, individually or in the aggregate, reveals details about capabilities and intentions of planned or ongoing program activities. If an adversary obtains this information, it could prevent or seriously degrade mission success. Based

Operations Security Plan on the information included CIL can be classified or unclassified, though unclassified//FOUO CIL preferred to facilitate internal dissemination.

Essential Elements of Friendly Information (EEFI) is simply CIL posed in the form of a question. It is imperative to understand that an answer to an EEFI is critical information and will be protected at all times. Appendix 1 is the JPO

JLTV CIL.

b. (U//FOUO) Analysis of Threats. Adversaries may conduct collection of information concerning JPO JLTV activities using various intelligence collection methods. When aggregated, this information can provide an accurate portrayal of friendly intentions or operations. The aim is to neutralize or manipulate the threat.

Collection threats are described in the PEO CS&CSS OPSEC Program; however, for detailed information about specific intelligence threats, the four questions that must be answered in relationship with threat analysis are as follows: ·

(1) (U//FOUO) What critical information is already known by the adversary?

(2) (U//FOUO) What gaps exist in the adversary information base that prevents it from deriving our critical information?

(3) (U//FOUO) What intelligence collection assets are available that will enable the adversary to exploit friendly actions?

(4) (U//FOUO) What are our potential OPSEC vulnerabilities?

c. (U//FOUO) Analysis of Vulnerabilities. This step identifies tentative OPSEC measures required to maintain essential secrecy. The most desirable OPSEC measures combine the highest protection with the least effect on JPO JLTV operational effectiveness. Appendix 2 is a list of potential JPO JLTV vulnerabilities and OPSEC measures.

d. (U//FOUO) Assessment of Risk. Because implementation of OPSEC measures usually presents a risk to operational, logistic, or procedural effectiveness, the OPSEC Officer will analyze them prior to the implementation/decision. The OPSEC Officer makes recommendations on each measure based on the following three questions:

(1) (U//FOUO) What is the risk to operational effectiveness if this

OPSEC measure is implemented?

(2) (U//FOUO) What is the risk to operations and the command mission success if this OPSEC measure is not implemented?

(3) (U//FOUO) What risk will result if this OPSEC measure fails to be effective?

Operations Security Plan

e. (U//FOUO) Application of Appropriate OPSEC Measures. The OPSEC Officer will select OPSEC measures based on the previous steps. OPSEC measures aid in the elimination of indicators or the vulnerability of actions to exploitation by an adversary. The OPSEC measures in Appendix 2 apply to all JPO JLTV personnel, and all personnel will adhere to them at all times. The JPO PM will approve each OPSEC measure based on the OPSEC Officer's recommendations and the answers to the questions in paragraph 4.d. OPSEC measures are methods and means used to gain and maintain essential secrecy about critical information. The following categories apply:

(1) (U//FOUO) Action Control. The objective is to eliminate indicators or the vulnerability of actions to exploitation by adversary intelligence systems. Select what actions to undertake; decide whether or not to execute actions and determine who, when, where, and how for actions necessary to accomplish tasks.

(2) (U//FOUO) Countermeasures. The objective is to disrupt effective adversary information gathering or prevent their recognition of indicators when collected materials are processed. Use diversions, camouflage, concealment, jamming, threats, police powers, and force against adversary information gathering and processing capabilities.

(3) (U//FOUO) Counter-analysis. The objective is to prevent accurate interpretations of indicators during adversary analysis of collected materials, and confuse the adversary analyst through deception techniques such as covers.

f. (U//FOUO) Conclusion. JPO JLTV will continually monitor the OPSEC posture via OPSEC assessments and comparing personnel actions to the requirements of this OPSEC Plan. Additionally, the OPSEC Officer will remain abreast of the current threat situation by liaison with other intelligence and security elements in the PEO.

5. (U) The POC for this OPSEC Plan is Gioacchino (Jack) Ciraulo, COM: 586-239-3491 or DSN: 273-3491, email: gioacchino.ciraulo.civ@mail.mil .

2 Encls

1. CIL/EEFI ·

2. Vulnerabilities and

OPSEC Measures

SHANE N. FULLMER

Colonel, AR Project Manager, Joint Program Office

Joint Light Tactical Vehicles mailto:gioacchino.ciraulo.civ@mail.mil

Operations Security Plan

UNCLASSIFIED/FOR OFFICIAL USE ONLY

(U) Appendix 1: JPO JLTV Critical Information List (CIL)

1. (U//FOUO) Below are the JPO JLTV Critical Information List. Critical information consists of specific facts about friendly intentions, capabilities, and activities vitally needed by adversaries for them to plan and act effectively to guarantee failure or unacceptable consequences for friendly mission accomplishment. Critical Information should be marked For Official Use Only (FOLIO) unless classified at a higher level by the JPO JLTV SCG or another governing SCG.

(U//FOUO) The Operations Security (OPSEC) Officer, in conjunction with a working group, develops the JPO JLTV Critical Information List (CIL) for approval by the Joint Program Office. It is the PM's intent that all personnel (military, civilian, and contractors) are aware of this CIL so they can better apply OPSEC to their daily tasks.

(U) The Critical Information is as follows:

a. (U//FOUO) Testing information for the JPO JLTV-Programs compromising location, date, time and method of transportation for non-armor components, vehicles, and/or equipment. This type of information is FOUO unless classified at a higher level by the JPO JLTV SCG or another governing SCG.

b. (U//FOUO) When, where and how often specific employee/teams/pairs of JPO

JLTV employees travel for government business, (i.e., Intelligence and Security Meetings, Electronics Testing, Worldwide Armor Conference, C41SR conference, etc.), is FOUO unless classified at a higher level by the JPO JLTV SCG or other governing SCG.

c. (U//FOUO) Specific current and projected system vulnerabilities.

Announcements on specific improvement for survivability, Intelligence or Combat Improvements, Electronic Warfare, or C41SR, capabilities, these are generally classified as SECRET however the classification should be checked in accordance with the JPO JLTV SCG or other governing SCG.

d. (U//FOUO) Operational readiness or specific equipment on a vehicle that is causing any operational issues of JPO JLTV units deployed or in the process of being deployed, this type of information is FOUO unless classified at a higher level by the JPO JLTV SCG or other governing SCG.

e. (U//FOUO) Photos of or information about vehicles or equipment that have been damaged by specific threats. Combat damage photos of any vehicle should not be commented on, noted or discussed in an open forum. No discussion of what type of IED Jammers or IED defeat systems are being worked on.

Operations Security Plan

Any information or threat or threat comments on anything that hits and penetrates our vehicles should not be posted on NIPR or in open source, these are generally classified as SECRET however the classification should be checked in accordance with the JPO JLTV SCG or other governing SCG.

f. (U//FOUO) Specific friendly force technologies using detailed Tactics, Techniques and Procedures (TTPs), organizational initiatives, and operational procedures. This type of information is FOUO unless classified at a higher level by the

g. (U//FOUO) IED CONOPS, IED TTPs, IED counter devices, counter IED capabilities or limitations, and ongoing counter IED upgrades. This type of information is at the minimum SECRET, refer to the JPO JLTV SCG or other governing SCG for further guidance.

h. (U//FOUO) Compilation of JPO JLTV personnel and contractor personnel working specific sensitive and classified areas of the JPO JLTV programs. This type of information is FOUO unless classified at a higher level by the JPO JLTV SCG or other governing SCG.

i. (U//FOUO) Identification of operational capabilities, operational limitations and vulnerabilities against ballistic, non-ballistic, nuclear, chemical, biological, and electronic warfare of the JPO JLTV Family of Vehicles. This type of information is at the minimum SECRET, refer to the JPO JLTV SCG or other governing SCG for further guidance.

j. (U//FOUO) Custom computer software/unique algorithms used in the JPO JLTV.

This includes Vetronics, Fire Control, implementation of VICTORY standards, wireless capabilities and limitations, Automotive System Controllers and application specific tuning, Cybersecurity/lnformation Assurance and crypto technologies applied, to include each systems real time operating environment and computer language requirements. This type of information is FOUO unless classified at a higher level by the JPO JLTV SCG or other governing SCG.

k. (U//FOUO) JPO JLTV vehicle network and information system detailed configurations and security rules (i.e. firewall rules, whitelist entries, anti-virus exclusions, JLTV unique directory permissions, SE Linux rules, etc.). This type of information is at the minimum SECRET, refer to the JPO JLTV SCG or other governing SCG for further guidance.

I. (U//FOUO) JPO JLTV programmatic and resourcing decisions not yet approved by the Army (i.e. program/contract cancellations, pre-POM/BES lock budget data, and shortfalls in meeting program cost, schedule and performance thresholds), or any inadvertent disclosure or loss of government and/or contractor financial information or source selection information. This type of information is FOUO unless classified at a higher level by the JPO JLTV SCG or other governing SCG.

Operations Security Plan

m. (U//FOUO) Identification of Critical Program Information (CPI) and Program Protection measures within the JPO JLTV and associated critical components and critical functions, Program Protection procedures, and anti-tampering implementation methods. This type of information is FOUO except those items/areas handling classified information and should be checked against the JPO JLTV SCG or other governing SCG.

n. (U//FOUO) Vendor specific technical integration on the JPO JLTV Family of

Vehicles. This type of information is FOUO unless classified at a higher level by the

o. (U//FOUO) Identification of pertinent ground, air, and sea lines of communication supporting JPO JLTV including; storage depots, airfields, ports and prepositioned stocks. This type of information is FOUO unless classified at a higher level by the JPO JLTV SCG or other governing SCG.

p. (U//FOUO) Identification of units to be equipped or deployments of JLTV. This type of information is FOUO unless classified at a higher level by the JPO JLTV SCG or other governing SCG.

2. (U//FOUO) OPSEC Indicators: OPSEC indicators are data derived from openly available information or detectable activities that an adversary can piece together or interpret to reach conclusions or estimates concerning program intentions, capabilities, or activities. The success of OPSEC depends on knowledge of how we are viewed from an adversary's perspective. If necessary, we will modify our actions, which will in turn change the perspective of an adversary.

(U) The following list of OPSEC indicators should not be considered all-inclusive.

a. (U//FOUO) Budget data that provide insight into objectives and scope of the JPO

JLTV R&D efforts.

b. (U//FOUO) Solicitations to subcontractors to integrate new or enhanced technologies onto the JLTV vehicle.

c. (U//FOUO) Design details revealing contactor proprietary of the JPO JLTV.

d. (U//FOUO) JPO JLTV information on test and exercise schedules that allows adversaries to better plan tests and exercises through the use of their intelligence collection assets.

e. (U//FOUO) JPO JLTV testing conducted at a specific location, date and time.

f. (U//FOUO) List of JPO JLTV personnel that handle classified information.

g. (U//FOUO) JPO JLTV equipment or system hardware itself.

Operations Security Plan

h. (U//FOUO) Unusual security clearance requirements.

i. (U//FOUO) Use of words indicating irregular activity (e.g. Critical, Rush, Priority, Sensitive).

j. (U//FOUO) Canceling leaves/recalling personnel to organization.

k. (U//FOUO) Posting of schedules, orders, flight itineraries, organizational charts, etc.

I. (U//FOUO) Discussing personnel, intelligence, operations, logistics, and plans over non- secure equipment.

m. (U//FOUO) Unusual or increased levels of TDY and conferences by senior officials and staff members.

n. (U//FOUO) Discussing problems or adverse personnel actions of individuals over non-secure equipment.

o. (U//FOUO) Security clearances annotated on TDY orders.

p. (U//FOUO) Conducting rehearsals for special activities.

q. (U//FOUO) Coordination with personnel at different locations.

r. (U//FOUO) Increased volume and priority of requisitions.

s. (U//FOUO) Planning for JPO JLTV conferences, symposia, and internal professional forums.

t. (U//FOUO) JPO JLTV rehearsals and drills concerning reactive armor.

u. (U//FOUO) JPO JLTV package or container labels that show the name of an operation, program designation and the classification.

Operations Security Plan

(U) Appendix 2-JPO JLTV Vulnerabilities and OPSEC Measures

1. (U//FOUO) Vulnerabilities: Vulnerabilities exist when an adversary can collect OPSEC indicators of critical information, correctly analyze the information, decide on an action, and execute the action. Their goal is to either prevent mission accomplishment or adversely affect mission success.

(U//FOUO) The following vulnerabilities were derived by comparing the intelligence collection threat against the JPO JLTV daily work routine.

a. (U//FOUO) Failure to use proper e-mail security when transmitting CUI (FOUO, technical data, or Personal Identifiable Information (Pll)) or critical information. CUI is susceptible to compromise when e-mailed without the proper security settings activated (i.e. must be digitally signed and Common Access Card (CAC) encrypted).

b. (U//FOUO) Information left unattended. Program information that is left in a conference room, vehicle, or hotel becomes susceptible to compromise or loss.

Information that can be viewed, lost or compromised may provide an adversary with valuable data that would allow them to develop systems to defeat our efforts, vehicles or equipment. In the same respect, Pll that is left in a conference room, vehicle or hotel can lead to an individual becoming the victim of identity theft. Examples of Pll information that if left unattended could lead to identity theft are: banking information, identification cards, medical paperwork, and personal data that has your social security number.

c. (U//FOUO) Unauthorized disclosure of test schedules, locations, and purpose allow foreign advocates to target our activities with HUMINT, IMINT, MASINT, and SIGINT resources. A lack of adequate OPSEC considerations during test planning and execution, to include movement of people and vehicles and site preparation could disclose test objectives; and other classified or unclassified program information.

d. (U//FOUO) Information disclosed during Industry Days, Symposiums, Meetings, or Professional Conferences must have an OPSEC review. Personnel are susceptible to elicitation and exploitation of information when attending these events by fellow participants or personnel from foreign countries. Personnel may also inadvertently make themselves a target for an intelligence agency with a point of contact for future information gathering attempts. Collection efforts may range from innocuous questions to actual blackmail by intelligence agents.

e. (U//FOUO) Conference Room or Defense Collaboration Services (DCS) Security.

Unauthorized or inadvertent release of JPO JLTV information to non JPO JLTV personnel supporting the effort. JPO JLTV currently operates in a Low Rate Initial Production (LRIP) phase and all material should be handled appropriately and protected at the classification level assigned. The host of all DCS meetings and the U.S.

Government participants need to be diligent in ensuring that our contractor's completion

Operations Security Plan of sensitive FOUO information is not compromised. The DCS Host will not allow individuals logging in as "guest." Users must log in as registered users. This will stop guest entering fake names as their log-in and will ensure that users logging in at all times have a need to know.

f. (U//FOUO) JPO JLTV CUI information (via the internet, media, meetings, etc.)

that has not gone through the public release process is not authorized for public release. Information that is release without authorization may provide valuable information regarding JPO JLTV equipment and platform capabilities, vulnerabilities, limitations, and requirements. Such information would allow an adversary to develop systems to defeat our equipment in development.

g. (U//FOUO) Lack of OPSEC awareness. JPO JLTV personnel do not fully realize their OPSEC responsibility in the protection of JPO JLTV information. Personnel are not fully aware of the intelligence value of unclassified information and the adversary's capability to decipher important intelligence data from seemingly non-critical information.

h. (U//FOUO) Communications transmissions: All unsecured telephone conversations (including cellular phones) are vulnerable to monitoring, and all long distance microwave transmissions are subject to intercept. Such vulnerabilities provide a source of information for intelligence agents. Communications supporting computer systems and faxes are equally vulnerable. Mailing program information is susceptible to interception or loss.

i. (U//FOUO) Teleconference and passcodes: JPO JLTV is currently operating in a LRIP phase; therefore all information will be handled in a secure way.

Teleconferences are an excellent way to share information, but we must ensure the communication process is done properly. The information discussed in teleconferences should be on a need to know basis and protected by all participating users. Facilitators, in order to keep the information secured do not share passcodes or passwords. Also, change passwords at least every six months. All teleconference participants must be registered users, guest users will not be allowed access to safe guard information.

2. (U//FOUO) OPSEC Measures: OPSEC measures are methods and means used to gain and maintain essential secrecy relative to the JPO's critical information. The most desirable OPSEC measures provide needed protection with the least amount of cost and impact on mission effectiveness and efficiency.

(U//FOUO) All personnel should know and employ the following OPSEC measures during their daily work routines. Application of these measures will prevent or mitigate the possibility of compromising critical information. The OPSEC Officer will develop additional OPSEC measures for crisis activities or as required.

Operations Security Plan

a. (U//FOUO) All e-mails containing CUI, FOUO, Pll or critical information will be encrypted or posted on the JPO JLTV Share Point, or AKO.

b. (U//FOUO) When Pll or JPO JLTV information is not in use, it should be secured and out of plain view.

c. (U//FOUO) When testing is involved with the JPG-JLTV, OPSEC considerations need to be part of the testing process, an approved OPSEC briefing must be given prior to the test being conducted to all authorized personnel participating in the testing.

d. (U//FOUO) When participating in Industry Day, Symposiums, Meetings, or

Professional Conferences, constant OPSEC awareness of potential threat and environment must be considered. Make sure that the facility is cleared (SECRET, Controlled Unclassified Information or Unclassified) for discussions or cleared to handle the information presented. Do not leave CUI or FOUO information unattended. When no longer needed, CUI, FOUO information must be shredded, to make certain that information is unreadable or is turned in to the security support staff for proper destruction. Make sure that you wear your ID badge only during the event. Secure badge from view when leaving the event. Report lost, or stolen badges immediately to the security support staff. Restrict JPO JLTV conversations to designated areas (i.e.

conference rooms). Report any suspicious activity or contacts to Army Military Intelligence, if activity is off DoD installations contact the local police, FBI, 902nd or G2, TACOM LCMC.

e. (U//FOUO) In addition to security training, employees are also provided

OCONUS Travel Training. This training is administered prior to the employee's travel to or through foreign countries. If available, receive an OPSEC threat briefing from G3, TACOM LCMC or the local Army Military Intelligence servicing that particular region prior to the activity.

f. (U//FOUO) Ensure that only authorized personnel associated with the program that have a need to know are only in attendance during a conference or when using DCS. Non JPO JLTV personnel (i.e. SETA contractors not supporting JPO JLTV, hotel/conference center staff, other government employees that do not have a need to know, etc.) will not be present in the room or dialed in during the conference session(s).

Room set up and catering service will be done prior to the conference start or during breaks. While the conference is in session, all doors will remain closed and entry into the room monitored. Attendees will refrain from using cell phone while the conference is in session. Laptops and handout materials will be secured from unauthorized viewing during or while not in session.

g. (U//FOUO) JPO JLTV information (documents, presentations, photos, videos, etc.)

that is intended to be presented outside the PEO CS&CSS, JPO JLTV and the DoD must be submitted and approved for public release. The public release process will consist of an OPSEC Review and technical review of the information to be presented to

Operations Security Plan

The general public to ensure that the information is current and accurate. Release of information outside PEO CS&CSS, JPO JLTV or DoD must be submitted for OPSEC review and to validate the receiving entity can protect the information commensurate with DoD, PEO CS&CSS and JPO JLTV protection measures. Information that is CUI will not be approved for public release.

h. (U//FOUO) Visitors to JPO JLTV facilities are required to process through established checkpoints for verification of identity, citizenship, personnel security clearances, appropriate certification of purpose of visit, and inspection of articles being brought into and out of the facility, before classified or unclassified information will be released. Visitors to JPO JLTV facilities or areas will be escorted at all times. Escorts for visitors shall be advised of proper escort procedures, limitations on disclosure, and other applicable controls involved in the visit. Personnel Within the area should be made aware of the visitor and reminded to secure CUI information from visitor view.

Personnel should also be mindful of the visitor's presence during telephone conversations. Be aware of custodial and maintenance personnel within the area.

Foreign national visitors may not access areas before the security representative and export focal have been informed. Prior to a foreign national visit, an e-mail will be sent to all personnel notifying them of the pending visit and to implement appropriate OPSEC procedures for the protection of JPO JLTV information. In some cases foreign visitors may be in a different part of the building but share common areas with program personnel. OPSEC procedures should be implemented so program information is not discussed in open areas. Foreign visitors are limited to the restrictions identified on the foreign visit request and must be escorted by a trained escort at all times.

i. (U//FOUO) Security education will include awareness among JPO JLTV personnel concerning the use of communications devices. Discussions of a classified nature via unsecured telephone are absolutely prohibited. For CUI data exchanges outside DoD networks, use only NIST/NIAP compliant solutions. Landline communications for telephone conversations are more secure than cellular and should be utilized whenever available for DoD, PEO CS&CSS or JPO JLTV CUI discussions.

All printed media and faxes will be retrieved immediately.

j. (U) Use the STA Form 7114 to conduct OPSEC reviews and STA Form 255 to conduct contract reviews.