N3904026Q5335_Attachment 2_Enclosure 2 PNSY OPSEC Contract Requirements 26-0181.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements attachment that outlines security protocols and information protection standards for contractors and subcontractors working at the facility.

The document establishes that an OPSEC plan must be signed by the Prime contractor and forwarded to the assigned contracting officer by encrypted email through the Department of Defense Safe (SAFE) Secure Access File Exchange or U.S. Postal Service. The specific OPSEC plan requirement has been marked as NOT REQUIRED for this contract, though the requirement may be determined during installation work. All contractors and subcontractors are responsible for protecting unclassified and classified information throughout contract performance, including avoiding inadvertent disclosure of Critical Information and Indicators (CII) and Controlled Unclassified Information (CUI). Contractors must not disclose sensitive government information to unauthorized third parties, including foreign entities, nor publish information on corporate networks, social media, or public websites. Critical information requiring protection includes personally identifiable information, operational schedules, equipment capabilities, facility vulnerabilities, asset identification, and photographs or videos taken within shipyard work areas. Contractors must implement countermeasures including removal of issued access badges upon departure, prohibition against posting shipyard-related information on social media, and immediate reporting of any unauthorized disclosure or suspected compromises to the unit sponsor, prime contract officer, and the Activity Security Manager. The document also addresses the Portable Electronic Device (PED) Policy, requiring coordination with sponsors before using devices with recording, photography, or data transmission capabilities within shipyard areas.