4311V100 OPSEC Assessment Questionnare for Contracts Enclosure 1 TEMPLATE UPDATE JUNE 2023.pdf

REV June 13, 2023

Enclosure (1)

Norfolk Naval Shipyard (NNSY) Operations Security (OPSEC) Assessment Questionnaire for Contracts

Tracking Number

Completing this form will help determine if the contractor could be exposed to, use, or produce, U.S.

Government critical information (CI), and determine if the contract needs an OPSEC plan.

1a. NAME OF NNSY REQUESTING ACTIVITY REPRESENTATIVE 1b. CODE 1c. PHONE OR IP EXTENSION

2. SELECT REQUESTING CONTRACT TYPE – CLASSIFIED CONTRACT UNCLASSIFIED CONTRACT

EXISTING or EXTENDING CONTRACT - YES NO IF YES, PLACE PREVIOUS TRACKING NUMBER HERE __________ 3a. NAME OF ASSIGNED CONTRACT REPRESENTATIVE 3b. EMAIL ADDRESS 3c. PHONE or IP EXTENSION NO

4. NAME OF CONTRACTING OFFICE OR GOVERNMENT CONTRACTING ACTIVITY (GCA)

Norfolk Naval Shipyard NAVFAC Other GCA ________________________________________________

5. TODAY’S DATE 6. PERFORMANCE START DATE 7. PERFORMANCE END DATE

Applicability and DoD Requirement This form is only completed by NNSY (UIC 42158) requiring activity representative requesting contract work on board NNSY. When submitting a requirement for a contract, this questionnaire shall be completed prior to solicitation or sole source award by the requiring activity, with the assistance from the assigned contracting representative, or Government Contracting Activity (GCA). The requiring activity representative, assigned contracting representative, or GCA must work with the NNSY OPSEC Program Manager (PM)to identify the scope of work to be performed and determine security provisions for Critical Information (CI) if disclosed in the Statement of Work (SOW), Request for Proposal (RFP), or Performance Work Statement (PWS).

Before the contracting representative submits to the supporting contracting company, the OPSEC PM is required to conduct an OPSEC review of the SOW, RFP, or PWS prior to the release to contract bidders. As a publicly released document, the SOW, RFP or PWS may reveal CI or indicators of CI.

What is an OPSEC Security Plan?

An OPSEC Plan is used to identify and monitor a contractor’s OPSEC activities during the performance of a contract. It is intended to be a living document that will require periodic updates throughout the life of the contract. The OPSEC plan; (1) Describes the OPSEC environment to include identification of CI, the OPSEC threat and vulnerabilities an adversary might exploit to acquire CI, (2) Documents the OPSEC risk analysis, (3) Identifies proposed and actual OPSEC measures,(4)Defines and assigns specific OPSEC responsibilities and ties the OPSEC Plan to the contractor’s corporate OPSEC Program, and (5) Serves as a repository of the OPSEC history of the contract.

If an OPSEC plan is required, the requirement activity representative, assigned contract representative, or GCA will forward the NNSY OPSEC Plan to the potential awardee by encrypted email, through Department of Defense Safe (DoD Safe) Secure Access File Exchange (https://safe.apps.mil). After award but prior to availability start date, the OPSEC plan must be signed by the Prime contractor and forwarded back to the assigned contracting official or the requirement activity representative by encrypted email. In other cases, the contractor may only simply be required to receive the basic OPSEC contract requirements, which means no OPSEC Plan is required.

Controlled by: DoN, NNSY Controlled by:

Manager CUI Category: OPSEC

LDC: DL ONLY

POC:

teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight

Assessment Questionnaire for Contracts – (cont) OPSEC Contract Requirements to Include in the Solicitation and Award

The OPSEC Contract Requirements and the OPSEC Standard Language are combined as one document. The OPSEC Contract Requirement document must be included in all solicitations and awards. This way, the OPSEC requirements are not buried in contract language and can be provided in a separate attachment.

NOTE: The OPSEC Standard Language must be included in all contract solicitation and the resulting contract awards in sufficient detail to ensure complete contractor understanding of all OPSEC provisions.

Assessment Questionnaire Complete the questionnaire, which identifies the scope of work to be performed. If any question below are answered “YES,” the contract may need an OPSEC Plan (Classified or Unclassified).

Will the contractor and subcontractors - Yes No

1. Work with Controlled Unclassified Information (CUI), Unclassified Naval Nuclear Propulsion Information (U-NNPI), or other pertinent sensitive information?

2. Work with any classified information, material or spaces, e.g., SECRET, CONFIDENTIAL - Restricted Data (C-RD), CONFIDENTIAL-National Security Information (C-NSI)?

3. Need escorted or un-escorted access on-board Surface Combatants, Virginia and Los Angeles Class Submarines and assigned Project locations?

4. Work with components, drawings, technical papers, architectural floor plans, diagrams inside or around any shipyard space, or equipment designed specifically for specialized production?

5. Need to access any NNSY information technology (IT) systems, to include installing audiovisual systems, installing software or repair IT systems in any shipyard space, ship or submarine?

6. Need to take photos or videos, around or in a shipyard workspace, including ships or submarines?

7. Use the US postal mail system for shipping and receiving of sensitive information or equipment?

Examples are but not limited - classified materials, sub safe equipment, computer parts, etc.

8. Repair or replace electrical equipment onboard a ship or submarine within the Controlled Industrial Area (CIA), this includes painting, installing, aligning, connecting, piping, hydrostatic testing, conducting operational test, removing existing insulation and lagging etc.

9. Conduct work within the CIA – not onboard a ship or submarine; such as dry docks, roadwork, working on cranes, storm drains, fence repair, trash removal, cleaning office spaces, food trucks etc.

10. Use computer equipment, such as company laptop or any company own electronic device to do work onboard NNSY? Understand NNSY Portable Electronic Device(PED) policy forbids the use of these items inside the CIA or other Naval Sea Systems Command spaces without permission from the NNSY Information Systems Security Manager (ISSM). Laptops, tablets, and other devices in this category cannot have web cameras and must be vetted through the ISSM and the Information Security Office.

11. Need access to classified networks, e.g., COMSEC, SIPRNET, and/or SECNET.

12. Make repair work or install alarm systems, building access codes or Intrusion Detection System (IDS), ATHOC/WAAN system, CCURE 9K Badging system.

13. Need access to shipyard-controlled spaces, e.g., SI, CNIA, NWA, OSC, OSS to include onboard a submarine?

14. Requires a Yellow or Red Badge, including access to (i.e. C-NNPI (C-RD/C-NSI))? If either, this will be a classified contract, which will require a DD 254.

15. Conduct work involving environmental, such as chemical storage, hazardous waste, food and water, safety/sanitation, ashore and afloat water/wastewater sanitation etc.

Add comments or any other additional procurement job work that needs protecting, not addressed.

teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight

Defense Federal Acquisition Regulation Supplement (DFARS) Clauses

Please include the DFARS clauses for all service support contracts that are appropriate.

Location of Work - Mark (N/A) if it does not apply

If the contractors are working on several vessels, various locations on the vessel(s) or throughout the shipyard, annotate in designated box below.

Vessel(s) Name: ____________________________________________________________________________________

Specific locations within the vessel(s), e.g., engine room: ____________________________________________________

Which Building(s), Room(s) & Floor(s):___________________________________________________________________

If other Shipyard location i.e., working on storm drains, streets, gates, fences ____________________________________

SI, CNIA, NWA, OSC, OSS, etc. _______________ In the CIA Not in the CIA

Which Pier(s) or Dry Dock(s): ________________________________________________________

Contractors involved with CUI in pursuant to contractual requirements must

Whenever the DoD provides CUI to, or CUI is generated by, non-DoD entities, protective measures and dissemination controls, including those directed by relevant law, regulation, or government-wide policy, will be articulated in the contract, grant, or other legal agreement, as appropriate.

Complete CUI training prior to arrival when required. Certificates must be provided to the OPSEC PM.

https://www.dodcui.mil/home/training

Certification and Concurrence

1. I hereby certify this document is true and correct to the best of my knowledge.

Requiring Representative __________________________ Signature

Assigned Contract Official __________________________ Signature

Date

2. Based on reviewing the SOW, RFP, or PWS, I concur with the requiring activity's representative assessment and validate the following Sensitive Activity And Intelligence Related Contracting (SAIRC) Questions.

1. Is there any portion of the work to be performed that cannot be published openly? Yes No N/A

2. Does the SOW, RFP or PWS or other requirements necessitate the use of sensitive compartmented information caveats / controls? Yes No N/A

3. Has the SOW, RFP, or PWS been cleared of any additional control markings, such as Distribution D, Export Controls, or Proprietary Business Information etc? Yes No N/A

4. Does the requirement support a sensitive activity or operations? Yes No N/A

Date Date teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight teresa.coon Highlight

Industrial Security Validation

Meeting is required No Meeting is required

Industrial Security Officer Signature Date

1. SOW review for DD-254 requirement prior to solicitation. DD-254 required? Y N

HIGHLIGHT ANSWER

If NO, No further action required 2. Contractor security requirements meets suitability after review.

Industrial Security Officer

Signature Date

HIGHLIGHT ANSWER

Contractor 1: Company Name __________________________ Cage Code _____________ Suitable: Y N

Contractor 2: Company Name __________________________ Cage Code _____________ Suitable: Y N

Contractor 3: Company Name __________________________ Cage Code _____________ Suitable: Y N

Contractor 4: Company Name __________________________ Cage Code _____________ Suitable: Y N

Contractor 5: Company Name __________________________ Cage Code _____________ Suitable: Y N

3. Award winning company DD-254 Received by C1122 and entered into CCD.

Industrial Security Officer

Signature Date

3. OPSEC PM concurs with assessment.

OPSEC Program Manager __________________________

Signature

OPSEC PM’s Determination

OPSEC Plan is required No OPSEC Plan is required

3. OPSEC PM concurs with assessment.

OPSEC Program Manager __________________________ _________________________ Date