N39040Q6021E410_Attachment 4_Enclosure 2 PNSY OPSEC Contract Requirements.pdf

This document is Portsmouth Naval Shipyard's Operations Security (OPSEC) Contract Requirements attachment, which outlines security protocols and information protection obligations for contractors working at the facility.

The document establishes that OPSEC is a process designed to protect sensitive and classified information from exploitation by adversaries. An OPSEC plan must be signed by the Prime Contractor and forwarded to the assigned contracting officer via encrypted email through the Department of Defense Safe (DoD) Secure Access File Exchange (SAFE) or U.S. Postal Service. The document indicates via checkbox that an OPSEC Plan is NOT required for this particular contract, though the requirements may apply depending on the type and environment of work performed. All contractors and subcontractors bear responsibility for avoiding inadvertent disclosure of unclassified or classified information during contract performance. Contractors cannot distribute Portsmouth Naval Shipyard (PNSY) Critical Information and Indicators (CII) to unauthorized third parties, including foreign entities with Foreign Ownership, Control or Influence (FOCI). The document prohibits publication of U.S. Government CII in corporate newsletters, trade magazines, websites, social media platforms, or personal email accounts, with media inquiries directed to PNSY Security and Public Affairs Office.

The document provides detailed guidance on protecting Controlled Unclassified Information (CUI) and identifies specific threat/risk examples including personally identifiable information, operation schedules, equipment capabilities, asset identification, and photographs within shipyard areas. Countermeasures include restricting classified information postings, properly shredding sensitive documents using NSA-approved equipment, prohibiting shipyard information on public social media, removing and returning access badges, and immediately reporting unauthorized disclosures or suspected compromises to the unit sponsor, prime contract officer, and the Activity Security Manager.