Attachment 2 - PNSY OPSEC Enclosure 2___Redacted.pdf

This document is an Operations Security (OPSEC) Contract Requirements form for Portsmouth Naval Shipyard that must be attached with solicitation and award documentation.

The form establishes OPSEC requirements to protect sensitive information from unauthorized disclosure, whether classified or unclassified. OPSEC is defined as a process to protect Critical Information and Indicators (CII) from exploitation by adversaries. An OPSEC plan must be signed by the Prime Contractor and forwarded to the contracting official via encrypted email through the Department of Defense Safe (DoD SAFE) or U.S. Postal Service. The form indicates that an OPSEC Plan is NOT required for this particular contract, though consideration may be given based on work type, environment, and circumstances. All contractors and subcontractors are responsible for avoiding inadvertent disclosure of unclassified or classified information during contract performance.

The document details specific threat categories and countermeasures contractors must implement. Threats include Personally Identifiable Information (PII), verbal discussion of shipyard work, operation and maintenance schedules, equipment capabilities and vulnerabilities, asset and facility identification, and photographs or videos in shipyard areas. Countermeasures require contractors to prohibit posting classified or unclassified information on public websites or social media, shred sensitive documents using NSA-approved methods, remove identification badges upon departure, report lost or stolen badges immediately, and report any unauthorized disclosures or suspected compromises to the unit sponsor, prime contract officer, and the Activity Security Manager. Contractors must understand that OPSEC compromise may result in criminal prosecution and imposition of civil and criminal penalties.