Operations Security (OPSEC) Guide for Defense Contractors

This document is a guidance manual for government contractors working with the Naval Undersea Warfare Center Division Keyport (NUWCDIVKPT) that establishes Operations Security (OPSEC) requirements and best practices for protecting Critical Information (CI) and sensitive unclassified material.

The guide defines OPSEC as an analytical process to identify Critical Information, assess threats and vulnerabilities, and implement countermeasures to protect CI from adversarial exploitation. OPSEC applicability is mandatory when contractors require physical access to NUWCDIVKPT facilities or other government facilities; have continuous or intermittent access requiring embedded personnel; handle government-supplied material for production of sensitive unclassified or classified components; or work on contracts with established OPSEC plans or involving Government CI. Contractors must adhere to three primary requirement sections: Section I establishes general contractor OPSEC requirements including restrictions on personal electronic devices, prohibitions on discussing government operations in public, restrictions on posting sensitive information to company media, proper handling and concealment of government badges and passes, destruction or return of government information at contract termination, and additional requirements for permanent onsite contractors including assignment of an OPSEC Point of Contact and mandatory OPSEC awareness training within 30 days of assignment and annually thereafter. Section II specifies training requirements for contracts with long-term facility access. Section III addresses contractor-developed OPSEC plans, requiring specific contract language and compliance with DoD Critical Program Information Protection directives. The guide includes comprehensive definitions of key terms such as Critical Information, OPSEC measures (action control, countermeasures, counter-analysis), indicators, observables, and sensitive information categories. Contractors are responsible for maintaining individual training records, coordinating OPSEC plans through proper channels for government approval, and ensuring all personnel supporting contracts receive initial and annual refresher OPSEC training. Costs associated with OPSEC compliance, including encryption software and training, shall be included in contractor proposals.