N3904026R3065 Attachment 5_PNSY OPSEC Contract Requirements 26-009.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements form that establishes security protocols and information protection standards for contractors working at the facility.

The document outlines that OPSEC is a process designed to protect sensitive information, including Critical Information and Indicators (CII), from unauthorized disclosure whether classified or unclassified. An OPSEC Plan must be signed by the Prime Contractor and forwarded to the contracting officer via encrypted email through the Department of Defense Safe (SAFE) Secure Access File Exchange or U.S. Postal Service, though the form indicates that an OPSEC Plan is NOT required for this particular contract. The document specifies that contractors and subcontractors are responsible for preventing inadvertent disclosure of classified or unclassified information throughout contract performance.

Critical Information and Indicators that contractors must protect include: personally identifiable information (PII), operational schedules and ship repair timelines, equipment capabilities and vulnerabilities, identification of specific assets and critical infrastructure, and photographs or videos taken within shipyard work areas. Contractors are prohibited from posting shipyard-related information on social media, corporate newsletters, or public websites, and must immediately report any unauthorized disclosures. Countermeasures required include destroying sensitive documents using approved NSA crosscut shredders, removing and returning all access badges upon contract completion, and reporting compromises to the unit sponsor, prime contract officer, and Activity Security Manager. The document also addresses Portable Electronic Device (PED) policy, requiring coordination with sponsors regarding approved devices and usage restrictions to prevent security violations.