N3904026Q3122 OPSEC Encl 2.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements attachment that outlines security protocols and sensitive information protection requirements for contractors and subcontractors performing work at the facility.

The document establishes that OPSEC is a process designed to protect sensitive information and Critical Information and Indicators (CII) from unauthorized disclosure, whether classified or unclassified. An OPSEC Plan must be signed by the Prime Contractor and forwarded to the assigned contracting official via encrypted email or U.S. Postal Service; however, this particular contract has been marked as not requiring an OPSEC Plan. All contractors and subcontractors are responsible for avoiding inadvertent disclosure of unclassified or classified information during contract performance. Critical Information requiring protection includes Personally Identifiable Information (PII), operation and repair schedules, equipment capabilities and vulnerabilities, facility and asset identification, and photographs or videos taken within shipyard work areas. Contractors must prevent posting of classified information or CUI on corporate websites, social media, or public platforms, and must shred sensitive documents using approved NSA crosscut shredders. Personnel must remove identification badges upon leaving the shipyard and report all unauthorized disclosures or suspected compromises immediately to the unit sponsor, prime contract officer, and the Activity Security Manager. Portable Electronic Devices (PEDs) such as cameras, smartphones, laptops, and similar devices are controlled and require coordination with the sponsor regarding approved usage and security requirements.