N3904026Q3191 Attachment 1- OPSEC Encl 2_Redacted.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements form that outlines security protocols and information protection standards for contractors performing work at the facility.

OPSEC is a process designed to protect sensitive information from exploitation by adversaries, including Critical Information and Indicators (CII) and unclassified or classified data. Contractors must develop and submit an OPSEC Plan (signed by the Prime Contractor and forwarded via encrypted email or postal service to the Department of Defense Safe Access File Exchange) unless specifically noted that one is not required on the form. All contractors and subcontractors are responsible for preventing inadvertent disclosure of unclassified or classified information throughout contract performance. Contractor personnel may be exposed to U.S. Government CII, which must not be distributed to unauthorized third parties, foreign governments, or companies under Foreign Ownership, Control, or Influence (FOCI). Critical information requiring protection includes personally identifiable information (PII), operation and repair schedules, equipment capabilities and vulnerabilities, identification of critical assets and facilities, and photographs or videos from shipyard work areas. Contractors must implement countermeasures such as refraining from posting classified information or Controlled Unclassified Information (CUI) on corporate websites, social media, or public platforms; shredding sensitive documents using approved NSA crosscut shredders; removing and returning access badges upon contract completion; and immediately reporting any unauthorized disclosure or suspected compromises to the unit sponsor, prime contract officer, and the Activity Security Manager. Violations may result in contract termination, removal of personnel, criminal prosecution, and civil penalties.