N3904026Q5515 Attachment 9 - OPSEC_Redacted.pdf

This document is Portsmouth Naval Shipyard's Operations Security (OPSEC) Contract Requirements guidance that must be attached to solicitations and awards.

OPSEC is a process designed to protect sensitive information and Critical Information and Indicators (CII) from disclosure by adversaries, whether classified or unclassified. An OPSEC Plan is used to record, identify, and monitor contractor OPSEC activities during contract performance. The document indicates that OPSEC Plan requirements are NOT required for this particular contract (based on the checked box), though consideration may be given depending on work type and environment. All contractors and subcontractors are responsible for avoiding inadvertent disclosure of unclassified or classified information throughout the contract period. Contractors may be exposed to U.S. Government CII and observable indicators, which must not be distributed to unauthorized third parties, including foreign entities under Foreign Ownership, Control or Influence (FOCI). Contractors must protect CII appropriately and must not publicize government information in corporate newsletters, trade magazines, websites, or social media. Unauthorized disclosure or compromise of CII may result in contract removal, termination, and criminal prosecution with civil and criminal penalties.

The document details specific threats and countermeasures for protecting sensitive information. Examples of CII include personally identifiable information (PII), operation and repair schedules, equipment capabilities and vulnerabilities, asset and facility identification, and photographs or videos within shipyard work areas. Countermeasures require contractors to restrict posting of classified or unclassified sensitive information online, shred documents using approved NSA crosscut shredders, remove and return badges upon contract completion, and immediately report unauthorized disclosures or suspected compromises to the unit sponsor, prime contract officer, and Activity Security Manager.