Attachment 2- OPSEC Encl 2_Redacted.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements form that outlines security obligations for contractors performing work at the facility.

The document establishes that OPSEC is a process to protect sensitive information from unauthorized disclosure, whether classified or unclassified. An OPSEC plan is required to record, identify, and monitor the contractor's security activities during contract performance and must be signed by the Prime contractor and forwarded to the assigned contracting officer via encrypted email or U.S. Postal Service. The form indicates that an OPSEC Plan is NOT required for this particular contract, though this determination may change based on installation-level assessment. Contractors and subcontractors are responsible for preventing inadvertent disclosure of unclassified or classified information and protecting Controlled Unclassified Information (CUI) and Critical Information and Indicators (CII). The document identifies examples of CII that require protection, including personally identifiable information, operation and repair schedules, equipment capabilities and vulnerabilities, facility and system identifications, and photographs or videos taken in shipyard work areas. Contractors must restrict verbal discussion of shipyard work, refrain from posting information on public websites or social media, remove identification badges upon departure, and immediately report any unauthorized disclosures or compromises to the unit sponsor, prime contract officer, and Activity Security Manager. Violations may result in contract termination, criminal prosecution, and civil penalties. The form also addresses Portable Electronic Device (PED) policy, requiring contractors to coordinate with their sponsor before using such devices on the shipyard premises.