N3904026Q3189 Attachment 1- OPSEC Encl 2_Redacted.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements attachment that establishes security protocols and information protection standards for contractors performing work at the facility.

The document defines OPSEC as a process to protect sensitive information from unauthorized disclosure, whether classified or unclassified. Contractors and subcontractors are required to develop and submit an OPSEC Plan (signed by the Prime contractor and forwarded through encrypted channels or postal service), though the document indicates via checkmark that an OPSEC Plan is NOT required for this particular contract. All contractor personnel must avoid inadvertent disclosure of unclassified or classified information and protect Controlled Unclassified Information (CUI) appropriately. Critical Information and Indicators (CII) that require protection include: personally identifiable information, operation and repair schedules, equipment capabilities and vulnerabilities, facility and infrastructure identification, and photographs or videos taken within shipyard work areas. Contractors must not publicize U.S. Government CII in corporate newsletters, trade magazines, or on social media and personal email accounts. Violations may result in contract termination, criminal prosecution, and civil penalties. Portable Electronic Devices (PEDs) are controlled and require sponsor approval before use. Additional countermeasures include proper shredding of sensitive documents using NSA-approved methods, removal of issued badges upon departure, immediate reporting of unauthorized disclosures or suspected compromises to the Activity Security Manager and Industrial Security Officer, and coordination with the PNSY Security and Public Affairs Office for any media requests.