Attachment 4 - Encl 2 PNSY OPSEC_Redacted.pdf

This document is Portsmouth Naval Shipyard's Operations Security (OPSEC) Contract Requirements form that must be attached with solicitations and awards.

The document establishes OPSEC requirements to protect sensitive unclassified and classified information from unauthorized disclosure during contract performance. An OPSEC plan must be signed by the Prime contractor and forwarded to the assigned contracting official via encrypted email through the Department of Defense Safe (DoD SAFE) or U.S. Postal Service. The determination of whether an OPSEC plan is required depends on the type of work performed and the installation environment, though some performance may require only the basic OPSEC contract requirements form. Contractors and subcontractors are responsible for avoiding inadvertent disclosure of unclassified or classified information, and personnel may be exposed to U.S. Government Critical Information and Indicators (CII). PNSY CII will not be distributed to unauthorized third parties, including foreign entities or companies under Foreign Ownership, Control, or Influence (FOCI). The document prohibits publishing government CII in corporate newsletters, trade magazines, displays, websites, or social media; transmission to personal email accounts; and posting on social media platforms. Disclosure or compromise of CII may result in contract termination and criminal prosecution.

The document includes a detailed OPSEC Critical Information and Indicators List (CIIL) identifying threats and countermeasures. Examples of critical information requiring protection include Personally Identifiable Information (PII), verbal discussions regarding shipyard work, operation and repair schedules, equipment capabilities and vulnerabilities, identification of critical assets and infrastructure, and photographs of shipyard work areas. Countermeasures include restricting posting of classified information or Controlled Unclassified Information (CUI) to company media, shredding sensitive documents using approved NSA crosscut shredders, removing badges upon departure, and immediately reporting unauthorized disclosures to the unit sponsor, prime contract officer, and Activity Security Manager.