N3904026Q3097 Attachment 1- OPSEC.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements attachment that outlines security protocols and information protection standards for contractors working at the facility.

The document establishes that OPSEC is a process to protect sensitive information from adversarial exploitation, with contractors required to implement an OPSEC Plan unless explicitly marked as "NOT required" on the document (which is checked for this contract). All contractors and subcontractors must avoid inadvertent disclosure of unclassified or classified information throughout the contract period. Contractors may be exposed to U.S. Government Critical Information and Indicators (CII) and must protect such information appropriately without distribution to unauthorized third parties, including foreign entities. CII cannot be publicized in corporate newsletters, trade magazines, displays, internet pages, public websites, or social media platforms, with all media requests directed to PNSY Security and Public Affairs. Unauthorized disclosure of CII may result in contract termination, criminal prosecution, and civil penalties.

The document includes a PNSY Portable Electronic Device (PED) Policy restricting the use of easily transportable devices capable of recording data, including smartphones, cameras, laptops, and USB devices, with usage dependent upon Shipyard guidance and sponsor coordination. The Critical Information and Indicators (CII) list identifies threat/risk examples including personally identifiable information, operational schedules, equipment capabilities, facility identification, and photographs within shipyard work areas. Corresponding countermeasures require contractors to prohibit posting of classified or CUI information on company websites or social media, shred sensitive documents using approved NSA crosscut shredders, refrain from posting shipyard information on public social media, remove identification badges upon departure, and immediately report any unauthorized disclosures to the unit sponsor and Activity Security Manager.