N3904026Q5283_ Attachment 2_ OPSEC.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements enclosure that outlines security obligations and information protection standards for contractors working at the facility.

The document establishes that OPSEC is a process to protect sensitive information from exploitation by adversaries, with an OPSEC plan required to be signed by the prime contractor and submitted to the contracting officer via encrypted email or U.S. Postal Service. As of the document date (1/14/26), an OPSEC Plan is not required for this particular contract. Contractors and subcontractors are responsible for preventing inadvertent disclosure of unclassified or classified information, with violations potentially resulting in personnel removal, contract termination, and criminal prosecution. Critical Information and Indicators (CII) subject to protection include personally identifiable information (PII), operation schedules, equipment capabilities and vulnerabilities, facility identification, and photographs or videos of shipyard work areas. Countermeasures required include prohibiting posting of classified or sensitive information on company websites or social media, proper document shredding using NSA-approved methods, immediate reporting of unauthorized disclosures, badge management protocols, and restrictions on verbal discussion of shipyard-related work. Portable Electronic Devices (PEDs) such as cameras, smartphones, and recording devices are controlled and require sponsor coordination before use. All personnel must report suspected compromises of CII to the Activity Security Manager Code 1120 and Industrial Security Officer immediately.