N0010426RX19777_Attachment 2_Enclosure 2 PNSY OPSEC Contract Requirements 26-035_Redacted.pdf

This document is an Operations Security (OPSEC) Contract Requirements notice issued by Portsmouth Naval Shipyard (PNSY), to be attached with solicitation and award documentation, with an effective date of February 17, 2026.

The document establishes OPSEC requirements for all contractors and subcontractors performing work at PNSY. OPSEC is a process designed to protect sensitive unclassified and classified information, including Critical Information and Indicators (CII), from unauthorized disclosure or exploitation. An OPSEC plan is required to record, identify, and monitor contractor OPSEC activities; however, this particular contract determination indicates that an OPSEC Plan is NOT required for this effort, though contractors remain responsible for protecting all sensitive information. All contractor personnel must avoid inadvertent disclosure of classified or unclassified government CII and observable indicators during contract performance. PNSY CII will not be distributed to unauthorized third parties or foreign entities, and contractors must protect all CII consistent with information classification levels. The document specifically prohibits publication of government CII in newsletters, trade magazines, internet pages, public websites, or social media platforms (including Facebook, Instagram, Twitter, and LinkedIn).

The document identifies specific examples of CII and countermeasures, including restrictions on personally identifiable information, operation and repair schedules, equipment capabilities and vulnerabilities, identification of critical infrastructure, and photographs or videos of shipyard work areas. Countermeasures include prohibiting posting of classified information or CUI on company websites, secure destruction of sensitive documents using NSA-approved crosscut shredders, removal of identification badges upon contract completion, and mandatory immediate reporting of any unauthorized disclosure or suspected compromises to the unit sponsor, prime contract officer, and the Activity Security Manager.