Attachment 2 PNSY OPSEC Contract Requirements 25-205_Redacted.pdf

This is an Operations Security (OPSEC) Contract Requirements document for Portsmouth Naval Shipyard that establishes security protocols and information protection standards for contractors and subcontractors.

The document defines OPSEC as a process to protect sensitive unclassified and classified information from unauthorized disclosure. An OPSEC plan must be signed by the Prime Contractor and forwarded to the contracting officer via encrypted email or U.S. Postal Service prior to work commencement. The OPSEC Plan is marked as NOT required for this particular contract, though consideration may be given depending on work type and environment. Contractors are responsible for preventing inadvertent disclosure of classified or unclassified information and protecting Critical Information and Indicators (CII) and Controlled Unclassified Information (CUI). Key restrictions include: prohibiting distribution of CII to unauthorized parties or foreign-owned entities; prohibiting publicization in corporate communications, newsletters, or social media; restricting photographs and videos within shipyard work areas including drydocks and submarines; and requiring immediate reporting of unauthorized disclosures to the Activity Security Manager and Industrial Security Officer. The document identifies specific threat categories including personally identifiable information (PII), operational schedules, equipment capabilities, asset identification, and critical infrastructure details. Countermeasures require that contractors not post classified or sensitive information on company websites, properly shred all sensitive documents using NSA-approved methods, remove identification badges upon departure, and report any suspected compromises or unauthorized access attempts.