# Operations Security

***[(OPSEC)]{.underline}***

***[Plan]{.underline}***

***[For]{.underline}***

***[Date:\_\_\_\_\_\_\_]{.underline}***

**[INTRODUCTION]{.underline}**

OPSEC is a systematic and proved process by which LANL and its
supporting contractors can deny to potential adversaries information
about capabilities and intentions by identifying, controlling, and
protecting generally unclassified evidence of the planning and execution
of sensitive LANL activities. The OPSEC process is most effective when
fully integrated into all planning and operational processes. The OPSEC
process involves five steps: identification of critical information,
analysis of threats, analysis of vulnerabilities, assessment of risk,
and application of appropriate countermeasures.

## SCOPE

This plan will provide information designed to show all
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ project participants what information
needs to be protected, what the threat is, what the potential
vulnerabilities are, what to do with the risk, and what countermeasures
can be applied to prevent information loss.

This plan is applicable to all \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
project participants.

## DEFINITIONS

***[Critical Program Information]{.underline}**:* Critical program
information (CPI) is information about intentions, capabilities, or
activities that must be protected from loss to keep an adversary from
gaining a significant military, economic, political, or technological
advantage.

The process to identify critical information begins with an examination
of the totality of the project to determine what exploitable but
unclassified evidence of classified or sensitive activity is vulnerable
to adversary acquisition in light of the known capabilities of potential
adversaries. Such evidence is usually derived from openly available
data. Certain "indicators" may be pieced together or interpreted to
discern critical information. Indicators commonly stem from the routine
administrative, physical, or technical actions taken to prepare for or
execute the project.

***[Indicators]{.underline}***: Detectable actions that can be heard,
observed, or imaged. Obtained by an adversary, they could result in
adversary knowledge or actions harmful to friendly intentions. They
include such things as: personnel or material actions and movements that
can be observed; public release conversations or documents; and habitual
procedures when conducting a given type of operation or test. All
detectable indicators that convey or infer critical information must be
identified and protected if determined vulnerable.

***[Threat Analysis]{.underline}***: Threat analysis is an examination
of an adversary's technical and operational capabilities, motivation,
and intentions to detect and exploit security vulnerabilities.

When considering threat, one must look at the CPI and the project in
general and look at that information as an adversary would. A
determination will need to be made as to who would want this technology,
who would want to discredit this project, who would like to cause harm
to the project participants, or who would like to do other nefarious
activities directed at the project. Once the adversary(ies) is
established, an analysis also needs to be done on capabilities, access,
determination, etc.

***[Analysis of Vulnerabilities]{.underline}***: Determining
vulnerabilities involves a systematic analysis of how a project is
actually conducted by the primary and supporting project team members.
The project must be viewed as an adversary might view it. Actions and
things that can be observed, or other data that can be interpreted or
pieced together to derive critical information, must be identified.
These potential vulnerabilities must be matched with specific threats.

Once it is determined what an adversary needs to know and where that
information is available, it is necessary to determine if it is possible
for the adversary to acquire and exploit the information in time to
capitalize on it. If so, vulnerability exists.

***[Risk Assessment]{.underline}***: Risk assessment is essentially the
process of balancing vulnerability against the threat, then deciding if
the resultant risk warrants applications of countermeasures. The
determination of risk is a demanding step in the OPSEC Process. It
requires a degree of subjective decision making based on the best
estimate of an adversary's intentions and capabilities.

Included in the assessment of an adversary's capability is not only his
ability to collect the information but also his capability to process
and exploit (evaluate, analyze, interpret) in time to make use of the
information. In order to complete the risk assessment, it is necessary
to combine this information (i.e., the possibility of the adversary
exploiting the information, with the resultant impact on the project).
This process should result in a list of recommendations along with an
estimate of the reduced impact upon the operation as achieved through
their application. The decision maker can then weigh the cost of
recommended OPSEC countermeasures in terms of resources and operational
effectiveness against the impact of the loss of critical program
information.

***[Application of Appropriate Countermeasures]{.underline}***: A
countermeasure is anything that effectively negates an adversary's
ability to exploit vulnerabilities. The most effective countermeasures
are simple, straightforward, procedural adjustments that effectively
eliminate or minimize the generation of indicators. Following a
cost-benefit analysis, countermeasures are implemented in priority order
to protect vulnerabilities having the most impact on the project, as
determined by the appropriate decision maker.

## RESPONSIBILITIES

It is the responsibility of the project leader to consider the OPSEC
Five-Step Process for \_\_\_\_\_\_\_\_\_\_\_\_ project.

(It is the responsibility of \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
(project member, security team member, etc.) to complete this OPSEC plan
for the project.)

It is the responsibility of all project participants to be aware of
OPSEC concerns associated with \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
project. All project participants shall read this OPSEC Plan (when
complete).

It is the responsibility of \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ project
team to develop a list of CPI and associated Indicators for
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ project.

It is the responsibility of \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ (team
member) to obtain a threat statement from (NIS Intelligence, CI, etc.)
on \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ project.

It is the responsibility of \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
project team to look at the vulnerabilities associated with
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ project.

It is up to the management of
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ project to
determine the risk for all potential vulnerabilities and to implement
any recommended countermeasures.

### CRITICAL PROGRAM INFORMATION

The CPI for \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ project is:

-   (List all CPI Here)

### INDICATORS

The indicators for \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
project are:

-   (List all known indicators and associate them with individual CPI)

(Examples of indicators in Appendix A)

### THREAT

The Threat for \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_
project is:

-   (List all known threats here along with potential adversaries)

### VULNERABILITIES

Ways information is vulnerable for
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ project:

-   Use of email between project participants;

-   Talking in public places;

-   Recycle bins;

-   Trash;

-   Procedures;

-   Web Pages (if applicable);

-   Other; (fill in as needed)

-   Other; (fill in as needed)

-   Other; (fill in as needed)

-   Other: (fill in as needed)

-   Etc.

### RISK

The following vulnerabilities are acceptable risks:

-   (Vulnerability)/(Why it is acceptable)

The following vulnerabilities will be countered with
(countermeasure(s)):

-   (Vulnerability)/(Countermeasure)

**[COUNTERMEASURES:]{.underline}**

See Appendix B for a sample list of countermeasures.

## CONCLUSION

By following the OPSEC Five-Step process
\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ project has identified
what it is that needs to be protected, what the threat is, what the
vulnerabilities are, what the risk is, and what countermeasures need to
be developed to protect any and all information associated with the
project. By doing so, the project team will have effectively mitigated
any potential information loss.