N3904026Q3120 Attachment 1 PNSY OPSEC Contract Requirements 26-033_Redacted.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements guide that outlines security obligations for contractors and subcontractors.

OPSEC is a process designed to protect sensitive information from exploitation by adversaries, specifically Critical Information and Indicators (CII)—unclassified or classified data requiring protection from unauthorized disclosure. An OPSEC Plan must be signed by the Prime Contractor and forwarded to the assigned contracting official via encrypted email through the Department of Defense Safe (DoD SAFE) or U.S. Postal Service. The requirement for a detailed OPSEC Plan depends on the type of work, environment, and circumstances; in some cases, contractors may only be required to acknowledge receipt of basic OPSEC contract requirements.

All contractors and subcontractors are responsible for preventing inadvertent disclosure of unclassified or classified information throughout contract performance. Contractors may be exposed to U.S. Government CII and observable indicators that could lead to CII disclosure; PNSY CII cannot be distributed to unauthorized third parties, including foreign governments or companies under Foreign Ownership, Control or Influence (FOCI). The document identifies specific threats and countermeasures, including prohibitions on publicizing government CII in newsletters, trade magazines, displays, internet pages, public websites, personal email accounts, or social media. Additional requirements address Portable Electronic Devices (PEDs), which require evaluation and approval before use on the shipyard, and mandate the protection of Controlled Unclassified Information (CUI). Contractors must immediately report unauthorized disclosures or suspected compromises of critical information to the Activity Security Manager, Industrial Security Officer, unit sponsor, and prime contract officer.