N3904026RX19769_Attachment 3_Enclosure 2 PNSY OPSEC Contract Requirements.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements form that establishes security protocols and information protection standards for contractors working on federal contracts at the facility.

The document outlines that OPSEC is a process designed to protect sensitive information from adversarial exploitation, including both classified and unclassified Critical Information and Indicators (CII). Contractors and subcontractors are required to submit an OPSEC Plan, though the document indicates that an OPSEC Plan is NOT required for this particular contract (as marked on the form dated 12/12/25). Contractors bear full responsibility for avoiding inadvertent disclosure of unclassified or classified information throughout the contract period. The form specifies that U.S. Government CII and observable indicators may not be distributed to unauthorized third parties, including foreign governments or companies under Foreign Ownership, Control, or Influence (FOCI), and must not be publicized in corporate newsletters, trade magazines, displays, internet pages, public websites, personal email accounts, or social media platforms. Any unauthorized disclosure or compromise of CII may result in removal of personnel, contract termination, criminal prosecution, and civil penalties.

The document further details that Portable Electronic Devices (PEDs) require coordination with the sponsor for approval prior to use at the shipyard. Critical Information and Indicators include examples such as personally identifiable information, operational schedules, equipment capabilities and vulnerabilities, facility identification, and photographs or videos within shipyard work areas. Countermeasures specified include prohibitions against posting classified or unclassified CUI on company websites or public media, mandatory shredding of sensitive documents using NSA-approved shredders, removal of issued badges upon departure, and immediate reporting of any unauthorized disclosures or suspected compromises to the unit sponsor, prime contract officer, and Activity Security Manager.