Attachment 1 Encl (2) PNS Operations Security Contract Requirements 25-260_REDACTED.pdf

This document is a contract requirements attachment from Portsmouth Naval Shipyard outlining Operations Security (OPSEC) compliance obligations for contractors. The document serves as an enclosure to be attached with solicitations and awards and references DoD and PTSM/HINST regulations regarding OPSEC procedures.

The document establishes that contractors must protect sensitive information and Critical Information and Indicators (CII) from unauthorized disclosure or exploitation. An OPSEC plan may be required and must be signed by the prime contractor and forwarded to the contracting officer by encrypted email or postal service; however, this particular solicitation has indicated that an OPSEC plan is NOT required. Contractors are responsible for protecting all classified and unclassified sensitive information, including Personally Identifiable Information (PII) and Controlled Unclassified Information (CUI), in a manner appropriate to the information's sensitivity. Contractors must not distribute CII to unauthorized third parties, publicize sensitive information through corporate communications, social media, or personal email accounts, or transmit shipyard-related information via public platforms. The document specifies critical information categories that require protection, including operational schedules, equipment capabilities, facility identification, asset vulnerabilities, and photographs or videos taken within shipyard work areas. Contractors must also implement physical security measures such as removing and returning access badges upon departure, reporting lost or stolen credentials immediately, and reporting any unauthorized disclosures or suspected compromises of critical information to the unit sponsor, prime contract officer, and Activity Security Manager. Violations may result in individual removal, contract termination, and criminal prosecution.