N3904026Q3116 Attachment (4) Enclosure 2 PNSY OPSEC.pdf

This document is an Operations Security (OPSEC) Contract Requirements enclosure for Portsmouth Naval Shipyard that outlines security protocols and information protection standards for contractor personnel and subcontractors.

The document establishes that OPSEC is a process designed to protect sensitive information and Critical Information and Indicators (CII) from unauthorized disclosure, whether classified or unclassified. An OPSEC Plan must be signed by the Prime contractor and forwarded to the assigned contracting officer via encrypted email or U.S. Postal Service, though this particular contract does not require a formal OPSEC Plan. All contractors and subcontractors bear responsibility for preventing inadvertent disclosure of classified or unclassified information. The document identifies specific categories of critical information that require protection, including Personally Identifiable Information (PII), operation schedules, ship repair schedules, submarine docking schedules, equipment capabilities and vulnerabilities, facility and infrastructure identification, and photographs or videos from shipyard work areas. Contractors are prohibited from publishing U.S. Government CII in newsletters, trade magazines, displays, websites, or social media platforms, and must not transmit sensitive information through personal email accounts or social media. The document details countermeasures including requirements to remove and return identification badges upon contract completion, shred all sensitive documentation using approved NSA crosscut shredders, immediately report unauthorized disclosures or suspected compromises to the unit sponsor and Activity Security Manager, and coordinate with the sponsor regarding Portable Electronic Device (PED) usage. Violations may result in contract termination, criminal prosecution, and civil penalties.