C07_B5945_Att_05_Guide_OPSEC_Rev_B.pdf

This document is an Operations Security (OPSEC) Guide for Defense Contractors developed by the Naval Undersea Warfare Center Division Keyport (NUWCDIVKPT). The guide provides comprehensive OPSEC requirements and best practices for government contractors working on NUWCDIVKPT contracts and other military facilities.

The guide establishes three levels of OPSEC requirements based on contract scope. Section I applies to contractors requiring physical access to NUWCDIVKPT facilities or government spaces, including personnel with intermittent or short-term access (construction, repairs, inspections), continuous access (embedded contractors, maintenance personnel), and those with direct access to government Critical Information (CI). Key Section I requirements include strict control over electronic devices in government spaces with approved equipment only; prohibition on discussing government operations in public or unencrypted communications; restrictions on posting sensitive images, data, or information to company websites or social media; non-disclosure of National Security Information including tactics, procedures, personnel movements, equipment modifications, and operational schedules; removal and concealment of government-issued badges when off-station; implementation of OPSEC countermeasures; protection of internal production schedules and vulnerabilities; and return or destruction of government information upon contract termination. Section II requires OPSEC training within 30 days of assignment and annually thereafter for contractors with long-term facility access, with training available through computer-based, live, or combined methods, and contractors must maintain individual training records. Section III addresses contractor-developed OPSEC plans required when contracts involve government Critical Information or established OPSEC plans exist, with specific guidance provided through Data Item Descriptor D-MGMT-80934B and requiring compliance with DoD 5200.39 Critical Program Information Protection guidelines. The guide emphasizes that OPSEC supplements but does not replace traditional security practices and that any cost associated with OPSEC compliance shall be included in contractor proposals as part of overall contract costs.