C7_Att05_OPSEC_Guide.pdf

This is an Operations Security (OPSEC) Guide for Defense Contractors developed by the Naval Undersea Warfare Center Division Keyport (NUWCDIVKPT). The guide is approved for public release and provides comprehensive guidance to government contractors, corporations, businesses, and independent contractors performing work for NUWCDIVKPT and other military facilities to ensure compliance with and protection of Nation Security Information.

OPSEC is defined as an analytical process to identify Critical Information (CI), assess threats and vulnerabilities to that information, and implement countermeasures to protect it. The guide applies to contractors with long or short-term physical access to NUWCDIVKPT facilities, vessels, or other government installations; those requiring continuous access such as embedded contractors; those with direct or indirect access to Government CI; and those producing sensitive unclassified material or components of classified systems. Contractors must adhere to minimum requirements including strict controls on introduction of personal electronic devices into government spaces, restrictions on discussing government operations in unprotected communications, prohibitions on posting sensitive information to company websites or social media, restrictions on photography and recording, proper handling and concealment of government-issued badges and identification, implementation of OPSEC countermeasures, and destruction or return of government information at contract termination. For permanent onsite contractors, requirements include assigning an OPSEC Point of Contact, providing initial OPSEC awareness training within 30 days of assignment and annual refresher training, maintaining individual training records, and properly marking and handling CI listed in the NUWCDIVKPT Command Critical Information List. When contractor-developed OPSEC plans are required, they must be approved by the NUWCDIVKPT Security Office and include internal training programs for all employees. Costs associated with OPSEC compliance, including encryption software and training, are included in the contractor's proposal response. The guide supplements but does not replace traditional security practices such as physical security and information security, and OPSEC requirements are additional to National Industrial Security Program Operating Manual (NISPOM) requirements.