N3904027Q1010 Attachment 2 -OPSEC Contract Requirements.pdf

This is an Operations Security (OPSEC) Contract Requirements document for Portsmouth Naval Shipyard that establishes security protocols and information protection standards for contractors and subcontractors.

The document defines OPSEC as a process to protect sensitive information from exploitation, with particular emphasis on Critical Information and Indicators (CII) that require safeguarding. An OPSEC Plan must be signed by the Prime Contractor and forwarded to the assigned contracting officer via encrypted email or U.S. Postal Service; however, the checkbox on this particular form indicates that an OPSEC Plan is NOT required for this contract. Contractors and subcontractors are responsible for preventing inadvertent disclosure of classified or unclassified information, with OPSEC compromise defined as disclosure of CII or sensitive information. The document prohibits distribution of CII to unauthorized third parties, including foreign governments or companies under Foreign Ownership, Control or Influence (FOCI), and restricts publication to corporate newsletters, trade magazines, displays, internet pages, public websites, personal email accounts, or social media platforms.

Critical Information requiring protection includes personally identifiable information (PII), operation and repair schedules, equipment capabilities and vulnerabilities, identification of assets and critical infrastructure, and photographs or videos of shipyard work areas. Countermeasures mandate that contractors not post classified or CII to company media, shred all sensitive information using NSA-approved methods, avoid posting shipyard information on social media, remove and return all access badges upon contract completion, and immediately report any unauthorized disclosures or suspected compromises to the unit sponsor, prime contract officer, and Activity Security Manager. Portable electronic devices (PEDs) require coordination with sponsors for approval before use on-site.