Attachment 3- OPSEC Encl 2_Redacted.pdf

This is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements document that establishes security protocols for contractors working at the facility.

The document defines OPSEC as a process protecting sensitive information from exploitation by adversaries, including Critical Information and Indicators (CII) that must be safeguarded whether classified or unclassified. An OPSEC plan is required to record, identify, and monitor contractor OPSEC activities during contract performance. The document indicates that an OPSEC plan is NOT required for this particular contract; however, consideration may be given based on the type of work, environment, and circumstances, with determination deferred to the installation level if needed. The document is signed and dated 10/23/26.

Contractors and subcontractors bear responsibility for avoiding inadvertent disclosure of unclassified or classified information and must protect Controlled Unclassified Information (CUI) appropriately. Personnel may be exposed to U.S. Government CII and observable indicators, which must not be distributed to unauthorized third parties, including foreign governments or companies under Foreign Ownership, Control or Influence (FOCI). The document prohibits publishing government CII in newsletters, trade magazines, displays, internet pages, or social media, with media requests directed to PNSY Security and Public Affairs. Violations may result in contract termination, criminal prosecution, and civil penalties. The document provides detailed examples of critical information (including personally identifiable information, operational schedules, equipment capabilities, facility identification, and photographs) and corresponding countermeasures such as proper document destruction, badge management, and immediate reporting of unauthorized disclosures to the Activity Security Manager.