N3904026Q0004 Attachment 3 - OPSEC Contract Requirements.pdf

This document is Portsmouth Naval Shipyard's Operations Security (OPSEC) Contract Requirements form, which serves as a security policy attachment for federal solicitations and awards.

The document establishes OPSEC requirements to protect sensitive government information from unauthorized disclosure. An OPSEC plan records, identifies, and monitors contractor OPSEC activities during contract performance and must be signed by the prime contractor and forwarded to the contracting officer via encrypted email or U.S. Postal Service. The document indicates that for this specific contract, an OPSEC Plan is NOT required. Contractors are responsible for protecting all Critical Information and Indicators (CII), Controlled Unclassified Information (CUI), and Personally Identifiable Information (PII) during the contract period. Critical information requiring protection includes operation schedules, ship repair schedules, equipment capabilities and vulnerabilities, specific asset and facility identification, photographs within shipyard work areas, and verbal discussions regarding shipyard work. Contractors must not publicize government CII in corporate communications, social media, or personal email accounts, and all media requests must be directed to PNSY Security and Public Affairs. Portable electronic devices (PEDs) such as cameras, smartphones, and laptops are controlled and their use depends on shipyard guidance and sponsor approval. Unauthorized disclosure of sensitive information may result in removal or contract termination and may warrant criminal prosecution. All suspected compromises of critical information must be reported immediately to the unit sponsor, prime contract officer, and the Activity Security Manager.