N0010426RX19785 Attachement 2 OPSEC_Redacted.pdf

This document is Portsmouth Naval Shipyard's Operations Security (OPSEC) Contract Requirements enclosure that outlines security protocols and sensitive information protection requirements for contractors.

OPSEC is a process designed to protect sensitive information and Critical Information and Indicators (CII) from unauthorized disclosure, whether classified or unclassified. An OPSEC plan must be signed by the Prime Contractor and forwarded to the assigned contracting official by encrypted email through the Department of Defense Safe (DoD SAFE) at https://safe.apps.mil or U.S. Postal Service. The document indicates that an OPSEC plan is NOT required for this particular contract, though consideration may be given depending on work type and environment. Contractors and subcontractors are responsible for avoiding inadvertent disclosure of unclassified or classified information and protecting Controlled Unclassified Information (CUI) appropriately. CII will not be distributed to unauthorized third parties, including foreign governments or companies under Foreign Ownership, Control or Influence (FOCI).

The document specifies prohibited activities including publishing U.S. Government CII in corporate newsletters, trade magazines, displays, or social media; transmitting sensitive information through personal email accounts; and posting on social media platforms. Critical information examples requiring protection include Personally Identifiable Information (PII), operation and repair schedules, equipment capabilities and vulnerabilities, asset and facility identification, and photographs within shipyard work areas. Countermeasures include not posting classified information online, shredding sensitive documents using approved NSA crosscut shredders, removing badges upon departure, and immediately reporting unauthorized disclosures or suspected compromises to the unit sponsor, prime contract officer, and Activity Security Manager.