Attachment 1 - N39040Q6134V600 2 PNSY OPSEC_Redacted.pdf

This is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements document that outlines security protocols and sensitive information protection requirements for contractors.

The document defines OPSEC as a process to protect sensitive information and Critical Information and Indicators (CII) from unauthorized disclosure. It references the OPSEC Plan for Contractors as a separate attachment and specifies that an OPSEC plan is NOT required for this particular contract work, though the plan must be signed by the Prime contractor and forwarded to the assigned contracting official. The document establishes contractor responsibility to avoid inadvertent disclosure of unclassified or classified information during contract performance, including protection of Controlled Unclassified Information (CUI) and Prevention of disclosure to foreign entities or companies under Foreign Ownership, Control or Influence (FOCI). Contractors and subcontractors are prohibited from publishing government CII in newsletters, trade magazines, social media, or personal email accounts, with violations potentially resulting in contract termination and criminal prosecution.

The document provides specific examples of CII that require protection, including personally identifiable information (PII), operation and repair schedules, equipment capabilities and vulnerabilities, facility and infrastructure identification, and photographs or videos taken in shipyard work areas. It outlines countermeasures including restrictions on posting classified or unclassified sensitive information to company websites or social media, proper document destruction using NSA-approved shredders, mandatory return of access badges upon contract completion, and immediate reporting of unauthorized disclosures or suspected compromises to the Activity Security Manager and Industrial Security Officer. The Portable Electronic Device (PED) Policy restricts use of devices capable of recording, copying, or transmitting data without prior coordination with the sponsor.