N3904026Q5426 Attachment 2 - OPSEC.pdf

This is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements document that outlines security protocols and information protection obligations for contractors working on federal contracts at the facility.

The document defines OPSEC as a process to protect sensitive information and Critical Information and Indicators (CII) from adversary exploitation. An OPSEC Plan is required to record, identify, and monitor contractor OPSEC activities during contract performance; however, the document indicates via checkbox that an OPSEC Plan is NOT required for this specific contract, with the determination date of 03/13/2026. Contractors and subcontractors are responsible for preventing inadvertent disclosure of classified or unclassified information throughout the contract period. The document prohibits distribution of U.S. Government CII to unauthorized third parties, including foreign entities with Foreign Ownership, Control or Influence (FOCI), and bars publication in corporate newsletters, trade magazines, social media, or public websites. Contractors must immediately report any unauthorized disclosures or suspected compromises to the Activity Security Manager and Industrial Security Officer.

The document provides detailed guidance on Portable Electronic Devices (PEDs) and identifies specific categories of Critical Information requiring protection, including Personally Identifiable Information (PII), operational schedules, ship repair schedules, equipment capabilities, facility identification, and photographs or videos taken within shipyard work areas. Required countermeasures include not posting classified or CUI information on company websites or social media, properly shredding sensitive documents using NSA-approved equipment, removing and returning access badges upon contract completion, and immediately reporting any losses or compromises of identification credentials or critical information to appropriate government officials.