N3904026Q3115 Attachment (5) Enclosure 2 PNSY OPSEC.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements form that establishes security protocols and information protection standards for contractors performing work at the facility.

The form outlines contractor responsibilities to protect sensitive and classified information from unauthorized disclosure throughout the contract period. OPSEC is defined as a process to protect critical information and indicators (CII) from adversarial exploitation, encompassing both classified and unclassified sensitive data. An OPSEC Plan, which must be signed by the Prime Contractor and forwarded to the contracting officer via encrypted email or U.S. Postal Service, is required to document and monitor contractor OPSEC activities. The form indicates that an OPSEC Plan is NOT required for this particular contract, though one may be required depending on work type and circumstances. Contractors and subcontractors must prevent inadvertent disclosure of unclassified or classified information and avoid OPSEC compromises, which constitute disclosure of Critical Information and Indicators or sensitive information to unauthorized parties. Contractors cannot publish U.S. Government CII in newsletters, trade magazines, websites, or social media; distribute PNSY CII to foreign entities under Foreign Ownership, Control or Influence (FOCI); or share information on personal email accounts or social media platforms. The document provides a detailed Critical Information and Indicators List (CIIL) identifying specific threat/risk categories—including personally identifiable information, operation schedules, equipment capabilities, facility identification, and photographs of shipyard work areas—and corresponding countermeasures such as proper document destruction, badge management, and immediate reporting of unauthorized disclosures to the Activity Security Manager and Industrial Security Officer.