Guide OPSEC.pdf

This document is an Operations Security (OPSEC) Guide for Defense Contractors (Revision B, dated May 1, 2016) issued by the Naval Undersea Warfare Center Division Keyport. The guide provides mandatory OPSEC compliance requirements for government contractors and businesses awarded work by the Naval Undersea Warfare Center Division Keyport (NUWCDIVKPT), other military facilities, and installations aboard U.S. Navy vessels and aircraft. OPSEC is defined as an analytical process to identify Critical Information (CI), assess threats and vulnerabilities to that information, and implement countermeasures to protect sensitive unclassified material and operations from adversarial collection or exploitation. The guide emphasizes that OPSEC supplements but does not replace traditional security practices such as physical security and information security, and is essential to protect Nation Security Information during contract performance.

The guide establishes three tiered sets of requirements based on contract scope. Section I specifies general contractor OPSEC requirements applicable to contracts involving physical access to NUWCDIVKPT facilities or vessels, access to government CI, production of sensitive unclassified material, or established OPSEC plans. Requirements include strict controls on personal electronic devices and photography, prohibitions on unencrypted communications regarding government operations, restrictions on posting sensitive information to company websites or social media, proper handling and destruction of government information, removal and concealment of government badges when off-station, implementation of countermeasures to protect CI, and internal training and marking of sensitive materials. Section II requires OPSEC training within 30 days of assignment and annually thereafter for contracts involving long-term access to facilities, with records maintained for compliance purposes. Section III applies to contracts for production of items with established OPSEC plans or involving government CI, requiring compliance with specific OPSEC Plan Requirements detailed in solicitation/contract language and Data Item Descriptor D-MGMT-80934B. Permanent onsite contractor personnel must assign an OPSEC Point of Contact and ensure all personnel receive OPSEC awareness training coordinated through government channels. The contractor must treat specified CI on the NUWCDIVKPT Command Critical Information List as FOR OFFICIAL USE ONLY (FOUO) and obtain NUWCDIVKPT OPSEC Officer approval before awarding subcontracts or finalizing an OPSEC plan. The document includes a comprehensive glossary of OPSEC-related terms and references applicable regulations and resources from the Defense Security Service, Interagency OPSEC Support Staff, National Counterintelligence Executive, and OPSEC Professionals Society.