N3904026Q3157 Attachment 1- OPSEC Encl 2_Redacted.pdf

This document is Portsmouth Naval Shipyard's Operations Security (OPSEC) Contract Requirements enclosure that must be attached to solicitations and contract awards.

The document establishes mandatory OPSEC protocols for all contractors and subcontractors performing work at Portsmouth Naval Shipyard to protect sensitive unclassified and classified information from unauthorized disclosure. Contractors must develop and submit an OPSEC Plan, which will be signed by the Prime Contractor and forwarded to the contracting officer via encrypted email through the Department of Defense Safe (DoD SAFE) system or U.S. Postal Service, though the requirement for a formal plan will be determined based on the type of work being performed and installation-specific guidance. Key contractor responsibilities include protecting Controlled Unclassified Information (CUI) and Critical Information and Indicators (CII) by prohibiting publication in corporate newsletters, trade magazines, social media, or public websites; restricting verbal discussions of shipyard-related work; shredding sensitive documents using NSA-approved crosscut shredders; and immediately reporting any unauthorized disclosures or suspected compromises to the unit sponsor, prime contract officer, and Activity Security Manager. Critical information that must be protected includes personally identifiable information (PII), operation and repair schedules, equipment capabilities and vulnerabilities, facility and asset identification, and photographs or videos taken within shipyard work areas. Additionally, contractors must manage Portable Electronic Devices (PEDs) in accordance with shipyard guidance and coordinate with sponsors regarding device approval. Violations may result in contract termination, removal of individuals from the contract, criminal prosecution, and imposition of civil penalties.