Attachment 4 - PHNSY IMF OPSEC Contract Requirements.pdf

Pearl Harbor Naval Shipyard Pearl Harbor Naval Shipyard and Intermediate Maintenance Facility Operations Security (OPSEC) Contract Requirements

Attach with Solicitation Reference DoDM 5205.02, Operations Security Program Manual, 3 November 2008

What is OPSEC?

OPSEC is a process used to protect sensitive information from exploitation by an adversary. Sensitive information, which is also referred to as Critical Information (CI), is defined as information that needs to be protected from unauthorized disclosure whether classified or unclassified.

Responsibility of the Contractor

During the period of this contract, contractor personnel may be exposed to, use, or produce, U.S. Government CI and observables indicators which may lead to discovery of CI. All contractors and subcontractors are responsible to comply with all measures outlined in the contract.

PHNSY&IMF Camera Personal Electronic Device (PED) Policy

Personal electronic devices (PEDs) include, but are not limited to: pagers, mobile/cellular telephones (with/without cameras), personal digital assistants/job performance aids, laptop/notebook/handheld computers, digital imagery (still/video) devices, analog/digital sound recorders (e.g. I-PODs), Fit-Bits, I-Watches, video game devices, USB devices, and devices of similar capability, functionality, or design. These devices are controlled and their use is dependent upon Shipyard guidance. Before use, coordinate with your sponsor, who can assist you by obtaining and sharing these requirements/controls with you. It is expected that if additional guidance is needed, the sponsor will coordinate with PHNSY&IMF Computer Security division and determine what can be used and what is prohibited. Failure to do so risks security violations for the holder of the device.

OPSEC Critical Information and Indicator List, including Countermeasures

Critical Information is an adversary’s target of choice. Seemingly, harmless UNCLASSIFIED data with other conversations, presentations, emails or documents could reveal classified information.

THREAT/RISK COUNTERMEASURES

EXAMPLES OF OUR

CRITICAL INFORMATION ARE, BUT NOT LIMITED TO:

• PERSONALLY IDENTIFIABLE INFORMATION (PII) –

INFORMATION ABOUT AN INDIVIDUAL THAT IDENTIFIES, LINKS,

RELATES, OR IS UNIQUE TO, OR DESCRIBES INDIVIDUALS, FOR

EXAMPLE, SOCIAL SECURITY NUMBER, AGE, HOME ADDRESS,

PERSONAL PRIVACY ISSUES, DEMOGRAPHIC, MEDICAL STATUS,

AND IDENTIFIERS COVERED BY PRIVACY ACT.

• RESTRICT VERBAL DISCUSSION REGARDING PHNSY&IMF

SHIPYARD RELATED WORK.

• OPERATION SCHEDULE, SHIP REPAIR SCHEDULE, DRILL AND

SUBMARINE DOCKING SCHEDULES.

• EQUIPMENT CAPABLITIES, LIMITATIONS AND VULNERABILITIES.

• IDENTIFICATION OF SPECIFIC ASSETS, FACILITIES, SYSTEMS, AND

NETWORKS CRITICAL INFRASTRUCTURE.

• RESTRICT PHOTOGRAPHS, IMAGES AND VIDEOS TAKEN WITHIN

ANY SHIPYARD WORK AREAS, TO INCLUDE DRYDOCKS, SHIPS,

RESTRICTED AREAS AND CONTROLLED ACCESS AREAS.

EXAMPLES OF OUR COUNTERMEASURES, BUT NOT LIMITED TO

• Contractor shall not post classified information or CUI to company websites, publications, newsletters or other media, images, data or information that reveal sensitive government operations, personnel, or equipment details.

• Shred ALL sensitive information, CUI and other pertinent critical information when no longer needed. Do not throw any shipyard related documents in the trash. Use the approved NSA crosscut shredders assigned.

• DO NOT post shipyard related information on public social media websites.

• Remove issued badges when you leave the shipyard, including lunch hours. Upon completion of contract, return all access badges, passes, keys before leaving PHNSY&IMF premises.

Badges and passes may not be duplicated, copied or loaned to others. Lost or stolen identification badges must be reported immediately.

• Report any unauthorized disclosure or, known and suspected compromises of critical information immediately to the unit sponsor, prime contract officer and the units Command Security Manager.