N3904026Q3039_OPSEC_Redacted.pdf

This document is an Operations Security (OPSEC) Contract Requirements enclosure for Portsmouth Naval Shipyard. It outlines mandatory security protocols and information protection standards that contractors and subcontractors must follow during contract performance.

The document defines OPSEC as a process protecting sensitive information from exploitation, specifically Critical Information and Indicators (CII) and unclassified information requiring protection. An OPSEC Plan must be signed by the Prime contractor and forwarded to the assigned contracting officer via encrypted email or U.S. Postal Service before contract award, though some cases may only require submission of basic OPSEC requirements form. Contractors and all personnel are responsible for preventing inadvertent disclosure of classified or unclassified sensitive information. Unauthorized disclosure of CII or sensitive information may result in removal of assigned personnel, contract termination, and criminal prosecution.

The document identifies threats requiring countermeasures, including Personally Identifiable Information (PII), verbal discussions of shipyard work, operational schedules, equipment capabilities, asset identification, and photographs or videos in shipyard work areas. Countermeasures mandate that contractors not post classified or CUI information on company websites, social media, or public forums; must shred sensitive documents using approved NSA equipment; must not post shipyard information on social media; must remove and return access badges upon departure; and must immediately report unauthorized disclosures to unit sponsors, prime contract officers, and Activity Security Managers. Portable Electronic Devices (PEDs) are controlled and require sponsor approval before use on shipyard premises.