N3904026Q0070 Attachment 3 Enclosure 2 PNSY OPSEC Redacted.pdf

This document is Portsmouth Naval Shipyard's Operations Security (OPSEC) Contract Requirements guidance that must be attached to all solicitations and awards.

The document establishes OPSEC procedures to protect sensitive government information from unauthorized disclosure during contract performance. An OPSEC plan is required to record, identify, and monitor contractor OPSEC activities, must be signed by the prime contractor, and forwarded to the contracting officer via encrypted email or U.S. Postal Service. However, the document indicates via checkmark that an OPSEC Plan is NOT required for this particular contract, though consideration should be given based on work type, environment, and circumstances. Contractors and subcontractors are responsible for preventing inadvertent disclosure of unclassified or classified information and protecting Controlled Unclassified Information (CUI). Critical Information and Indicators (CII) examples include personally identifiable information, operational schedules, equipment capabilities, facility identification, photographs, and submarine docking schedules. Countermeasures specify that contractors must not post classified information or CUI on company websites, social media, or publications; must shred sensitive documents using approved NSA crosscut shredders; must remove and return access badges upon contract completion; and must immediately report unauthorized disclosures or suspected compromises to the unit sponsor, prime contract officer, and Activity Security Manager. Unauthorized disclosure may result in contract termination and criminal prosecution.