N390406036V100 Attachment 2 OPSEC Redacted.pdf

This is a contract requirements document for Operations Security (OPSEC) at Portsmouth Naval Shipyard, establishing mandatory security protocols for all contractors and subcontractors working on federal contracts at the facility.

The document outlines that OPSEC is a protective process designed to safeguard sensitive and critical information from unauthorized disclosure, whether classified or unclassified. Contractors must develop and submit an OPSEC Plan signed by the Prime Contractor and forwarded to the assigned contracting official via encrypted email through the Department of Defense Safe (DoD SAFE) or U.S. Postal Service, unless the contracting officer determines an OPSEC Plan is not required for the specific work performance. The document identifies Critical Information and Indicators (CII) that require protection, including personally identifiable information (PII), operation and maintenance schedules, equipment capabilities and vulnerabilities, facility and infrastructure details, and photographic or video documentation of shipyard work areas. Contractors are prohibited from disclosing classified or unclassified sensitive information through corporate communications, social media, personal email accounts, trade publications, or public websites. Countermeasures require contractors to protect all sensitive information using approved methods such as NSA-approved cross-cut shredders for document disposal, immediate reporting of unauthorized disclosures or suspected compromises to the unit sponsor and Activity Security Manager, return of all access badges and identification upon contract completion, and restriction of portable electronic devices absent sponsor coordination and security approval. Non-compliance may result in contract termination, criminal prosecution, and civil penalties. The document references DoDM 5205.02, OPSEC Policy, and PTSMHINST directives as governing authorities.