N390406156V628 Attachment 2_OPSEC Contract Requirements_Redacted.pdf

This document is a contract requirements sheet for Operations Security (OPSEC) at Portsmouth Naval Shipyard.

The document establishes OPSEC requirements that contractors must follow to protect sensitive and classified information from unauthorized disclosure. OPSEC is defined as a process to protect Critical Information and Indicators (CII) from exploitation by adversaries, encompassing both classified and unclassified sensitive information. Contractors and subcontractors are responsible for avoiding inadvertent disclosure of unclassified or classified information throughout the contract period. An OPSEC Plan is required in some cases and must be signed by the Prime contractor and forwarded to the contracting officer via encrypted email or postal service; however, the specific checkbox indicates that an OPSEC Plan is NOT required for this particular contract. The document specifies that OPSEC compromise—the disclosure of CII or sensitive information—may result in removal of personnel, contract termination, criminal prosecution, and imposition of civil and criminal penalties.

The document provides detailed guidance on Controlled Unclassified Information (CUI) handling and identifies specific CII threats and required countermeasures. Critical information examples include Personally Identifiable Information (PII), operational schedules, equipment capabilities and vulnerabilities, facility and asset identification, and photographs of shipyard work areas. Countermeasures require contractors to prohibit posting of classified or unclassified sensitive information on company websites or social media, shred all sensitive documents using NSA-approved equipment, remove and return badges upon contract completion, and immediately report any unauthorized disclosures or suspected compromises to the unit sponsor, prime contract officer, and the Activity Security Manager.