Attachment 2 - OPSEC Form.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements form that outlines security protocols and information protection standards for contractors working at the facility.

OPSEC is a process designed to protect sensitive and Critical Information and Indicators (CII) from unauthorized disclosure, whether classified or unclassified. An OPSEC plan is required to document, identify, and monitor contractor OPSEC activities during contract performance, though this particular contract does not require a formal OPSEC plan submission. All contractors and subcontractors are responsible for preventing inadvertent disclosure of unclassified or classified information and protecting Controlled Unclassified Information (CUI) appropriately. Contractor personnel may be exposed to U.S. Government CII, which must not be distributed to unauthorized parties, including foreign entities, and cannot be publicized through corporate communications, trade publications, social media, or public websites. Any unauthorized disclosure may result in contract termination, criminal prosecution, and civil penalties.

The document identifies examples of CII requiring protection, including personally identifiable information, operation schedules, equipment capabilities and vulnerabilities, facility and infrastructure details, and photographs or videos of shipyard work areas. Specific countermeasures are mandated, such as prohibiting posting of classified or CUI information on company media, shredding sensitive documents using approved NSA methods, removing and returning access badges upon contract completion, and immediately reporting any suspected compromises to the activity security manager and prime contract officer. Portable electronic devices (PEDs) are controlled and require coordination with the sponsor before use at the shipyard.