N3904026Q5320 Attachment 2 - OPSEC_Redacted.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements enclosure outlining security protocols and information protection standards for contractors performing work at the facility.

The document establishes that OPSEC is a process to protect sensitive and unclassified information from unauthorized disclosure. An OPSEC plan is required to record, identify, and monitor contractor OPSEC activities during contract performance. The document indicates that an OPSEC plan is NOT required for this particular contract, signed on January 23, 2026. All contractors and subcontractors are responsible for avoiding inadvertent disclosure of unclassified or classified information. Critical Information and Indicators (CII) that require protection include: personally identifiable information (PII), operation and ship repair schedules, equipment capabilities and vulnerabilities, identification of specific assets and critical infrastructure, and photographs or videos taken in shipyard work areas. The contractor must not publicize government CII in newsletters, trade magazines, websites, social media, or personal email accounts. Unauthorized disclosure may result in contract termination, criminal prosecution, and civil and criminal penalties.

The document also addresses Portable Electronic Devices (PEDs) policy, specifying that contractors must coordinate with their sponsor regarding approved devices for use at the shipyard. Countermeasures for protecting sensitive information include: prohibition on posting CII to company websites or publications, shredding all sensitive documents using approved NSA crosscut shredders, removal and return of all access badges and passes upon contract completion, and immediate reporting of any unauthorized disclosures or suspected compromises of critical information to the unit sponsor, prime contract officer, and the Activity Security Manager.