N3904027Q3160 Attachment 1- OPSEC Encl 2_Redacted.pdf

This document is Portsmouth Naval Shipyard's Operations Security (OPSEC) Contract Requirements enclosure that must be attached with solicitation and award documentation.

The document establishes OPSEC requirements to protect sensitive information from unauthorized disclosure during contract performance. An OPSEC plan is used to record, identify, and monitor contractor OPSEC activities; however, this particular contract does not require an OPSEC plan submission, though one may be required depending on the installation where work is conducted. Contractors and subcontractors bear responsibility for preventing inadvertent disclosure of classified or unclassified information and must protect Controlled Unclassified Information (CUI) appropriately. Critical Information and Indicators (CII) that require protection include personally identifiable information, operation and repair schedules, equipment capabilities and vulnerabilities, asset and facility identifications, and photographs or videos taken in shipyard work areas. Contractors must not distribute CII to unauthorized parties, post sensitive information on corporate websites or social media, publicize information in newsletters or trade publications, or transmit classified data through personal email accounts. Countermeasures require contractors to shred sensitive documents using approved NSA crosscut shredders, remove badges upon leaving shipyard premises, return all access credentials upon contract completion, immediately report any unauthorized disclosures or suspected compromises, and direct media requests to PNSY Security and Public Affairs. Personnel should understand that disclosure or compromise of CII through willful negligence, carelessness, or indiscretion may result in contract termination and criminal prosecution. Portable electronic devices require coordination with sponsors for approved use and security compliance.