attach 8. PHNSY&IMF OPSEC CONTRACT REQUIREMENTS.08-16-21 AM.pdf

Pearl Harbor Naval Shipyard Pearl Harbor Naval Shipyard and Intermediate Maintenance Facility Operations Security Contract Requirements

Attach with Solicitation References

- DoDM 5205.02, Operations Security Program Manual, 3 November 2008

- SECNAV Instruction 3070.2A, Operations Security

- DoD Instruction 5200.48, Controlled Unclassified Information (CUI), 6 March 2020

- DoD 5220.22, Volume 2, National Industrial Security Program, 1 August 2018

What is OPSEC?

OPSEC is protecting sensitive unclassified information from our adversaries. Sensitive unclassified information, which is also referred to as Critical Information (CI), is defined as information that needs to be protected from unauthorized disclosure. Disclosure of such information could provide our adversaries critical information about our capabilities, activities, limitations and intentions.

What is Critical Information (CI)?

CI is sensitive information whether classified or unclassified which must be protected from loss to keep an adversary from gaining a significant operational, economic, political or technological advantage and prevent adverse impact of the Shipyard’s mission success.

OPSEC Basic Contract Requirements

All contractor (including subcontractor) personnel assigned to this contract will accomplish the following requirements in support of Pearl Harbor Naval Shipyard and Intermediate Maintenance Facility (PHNSY&IMF) Operations Security (OPSEC) Program:

What is an OPSEC Plan? An OPSEC plan is used to record, identify and monitor the contractor’s OPSEC activities during the performance of the contract. If determined, and prior to award, an OPSEC Plan must be signed by the Prime contractor and forwarded to the assigned contracting official by encrypted email, through the approved Department of Defense Safe (DoD) Secure Access File Exchange (SAFE) at https://safe.apps.mil, or by United States Postal Service.

Consideration shall be given depending on the type of work being performed, the environment, and circumstances in which contract performance will occur. In some cases, an OPSEC Plan will be required. In other cases, the contractors may only simply be required to receive this basic OPSEC requirements form.

Either way, it is the responsibility of all contractors and subcontractors to avoid inadvertent disclosure of unclassified or classified information during the period of this contract.

OPSEC compromise is the disclosure of CI or sensitive information, which has been identified by the Command and any higher headquarters to adequately protect its personnel and equipment.

During the period of this contract, contractor personnel may be exposed to, use, or produce, U.S. Government CI and observable indicators which may lead to discovery of CI. PHNSY&IMF CI will not be distributed to unauthorized third parties, including foreign government or companies under Foreign Ownership, Control or Influence (FOCI). The contractor shall protect all CI in a manner appropriate to the nature of the information.

U.S. Government CI shall not be publicized in corporate wide newsletters, trade magazines, displays, internet page or public websites. All transmission to personal email accounts (AOL, Yahoo, Gmail, Hotmail, Comcast, etc.,) and posting on social media websites (Facebook, Instagram, Twitter, LinkedIn, etc.,) are prohibited. Media requests related to this project shall be directed to PHNSY&IMF Public Release Authority.

OPSEC Contract Requirements https://safe.apps.mil/

OPSEC Contract Requirements (cont)

The Contractor and its personnel should realize that disclosure or compromise of CI to unauthorized persons, whether willfully or through gross negligence, carelessness, or indiscretion, may warrant action to remove the individual assigned or to terminate contract. Furthermore, such conduct may be cause for criminal prosecution and imposition of criminal and civil penalties.

Protect Controlled Unclassified Information (CUI): Unclassified information requiring safeguarding and dissemination controls, consistent with applicable law, regulation, or government-wide policy. Any attempt by unauthorized third parties to solicit, obtain, photograph or record incidents of loss or compromise of CUI or other pertinent sensitive information related to this contract shall be immediately reported to the organization’s Command Security Manager.

These OPSEC requirements shall not be imposed at an additional cost to the U. S. Government.

PHNSY&IMF Camera Personal Electronic Device (PED) Policy

Personal electronic devices (PEDs) include, but are not limited to: pagers, mobile/cellular telephones (with/without cameras), personal digital assistants/job performance aids, laptop/notebook/handheld computers, digital imagery (still/video) devices, analog/digital sound recorders (e.g. I-PODs), Fit-Bits, I-Watches, video game devices, USB devices, and devices of similar capability, functionality, or design. These devices are controlled and their use is dependent upon Shipyard guidance. Before use, coordinate with your sponsor, who can assist you by obtaining and sharing these requirements/controls with you. It is expected that if additional guidance is needed, the sponsor will coordinate with C/109 (Computer Security) and determine what can be used and what is prohibited. Failure to do so risks security violations for the holder of the device.

OPSEC Critical Information and Indicator List, including Countermeasures

Critical Information is an adversary’s target of choice. Seemingly, harmless UNCLASSIFIED data with other conversations, presentations, emails or documents could reveal classified information.

THREAT/RISK COUNTERMEASURES

SOME EXAMPLES OF OUR

CRITICAL INFORMATION ARE, BUT NOT LIMITED TO:

• PERSONALLY IDENTIFIABLE INFORMATION (PII) –

INFORMATION ABOUT AN INDIVIDUAL THAT IDENTIFIES,

LINKS, RELATES, OR IS UNIQUE TO, OR DESCRIBES

INDIVIDUALS, FOR EXAMPLE, SOCIAL SECURITY NUMBER,

AGE, HOME ADDRESS, PERSONAL PRIVACY ISSUES,

DEMOGRAPHIC, MEDICAL STATUS, AND IDENTIFIERS

COVERED BY PRIVACY ACT.

• RESTRICT VERBAL DISCUSSION REGARDING PHNSY&IMF

SHIPYARD RELATED WORK.

• OPERATION SCHEDULE, SHIP REPAIR SCHEDULE, DRILL AND

SUBMARINE DOCKING SCHEDULES.

• EQUIPMENT CAPABLITIES, LIMITATIONS AND

VULNERABILITIES.

• IDENTIFICATION OF SPECIFIC ASSETS, FACILITIES, SYSTEMS,

AND NETWORKS CRITICAL INFRASTRUCTURE.

• RESTRICT PHOTOGRAPHS, IMAGES AND VIDEOS TAKEN

WITHIN ANY SHIPYARD WORK AREAS, TO INCLUDE

DRYDOCKS, SHIPS, RESTRICTED AREAS AND CONTROLLED

ACCESS AREAS.

SOME EXAMPLES OF OUR COUNTERMEASURES, BUT

NOT LIMITED TO

• Contractor shall not post classified information or CUI to company websites, publications, newsletters or other media, images, data or information that reveal sensitive government operations, personnel, or equipment details.

• Shred ALL sensitive information, CUI and other pertinent critical information when no longer needed. Do not throw any shipyard related documents in the trash. Use the approved NSA crosscut shredders assigned.

• DO NOT post shipyard related information on public social media websites.

• Remove issued badges when you leave the shipyard, including lunch hours. Upon completion of contract, return all access badges, passes, keys before leaving PHNSY&IMF premises. Badges and passes may not be duplicated, copied or loaned to others. Lost or stolen identification badges must be reported immediately.

• Report any unauthorized disclosure or, known and suspected compromises of critical information immediately to the unit sponsor, prime contract officer and the units Command Security Manager.