Attachment 1 - OPSEC Enclosure 2.pdf

This document is an Operations Security (OPSEC) Contract Requirements guide for Portsmouth Naval Shipyard that must be attached to solicitations and awards.

The document establishes OPSEC requirements to protect sensitive information from adversarial exploitation, including both classified and unclassified critical information. An OPSEC plan is not required for this contract based on the checked box indicating "OPSEC Plan is NOT required." All contractors and subcontractors are responsible for preventing inadvertent disclosure of unclassified or classified information throughout contract performance. Contractors must protect Controlled Unclassified Information (CUI) and Critical Information and Indicators (CII) through appropriate safeguarding measures. CII examples that require protection include personally identifiable information, operation schedules, equipment capabilities and vulnerabilities, asset and facility identification, and photographs or videos taken within shipyard work areas. Contractors are prohibited from publishing shipyard-related information on corporate websites, newsletters, social media platforms, or personal email accounts. Disclosure of CII to unauthorized third parties, foreign governments, or companies under Foreign Ownership, Control or Influence (FOCI) is prohibited and may result in contract termination or criminal prosecution. The Portable Electronic Device (PED) Policy requires coordination with the sponsor before using portable devices at Portsmouth Naval Shipyard, with approval dependent on security evaluation. All access badges must be returned upon contract completion, and any unauthorized disclosures or suspected compromises must be immediately reported to the unit sponsor, prime contract officer, and the Activity Security Manager.