N3904026Q0043 OPSEC Encl 2.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements form that establishes security protocols for contractors working on federal contracts at the facility.

The document outlines OPSEC requirements designed to protect sensitive information from unauthorized disclosure, whether classified or unclassified. An OPSEC plan is required to record, identify, and monitor contractor OPSEC activities during contract performance and must be signed by the Prime Contractor and forwarded to the contracting official via encrypted email or postal service. For this specific contract, the OPSEC Plan is marked as NOT REQUIRED (with a date of 12/17/25). Contractors are responsible for protecting Critical Information and Indicators (CII) and Controlled Unclassified Information (CUI) in accordance with applicable policies referenced from DoD 5205.02, PTSMHINST 5510.27A, and related security directives. Prohibited activities include publishing classified or unclassified government information in corporate newsletters, trade magazines, internet pages, social media platforms, or personal email accounts. Disclosure or compromise of CII to unauthorized parties may result in contract termination, criminal prosecution, and civil penalties. The document identifies specific threat/risk categories including personally identifiable information, operational schedules, equipment capabilities, facility identification, and photographs of shipyard work areas. Countermeasures specified include prohibiting posting of sensitive information on company websites or social media, proper document destruction using approved NSA crosscut shredders, mandatory badge removal upon departure, and immediate reporting of any unauthorized disclosures or suspected compromises to the unit sponsor and contracting officer.