N39040Q6036V238 Attachment 2_Enclosure 2 PNSY OPSEC Contract Requirements_6036V2381.pdf

This is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements document that establishes security protocols and information protection standards for contractors working on federal shipyard contracts.

The document defines OPSEC as a process to protect sensitive information from exploitation by adversaries, with particular emphasis on Critical Information and Indicators (CII) and Controlled Unclassified Information (CUI). An OPSEC plan must be signed by the prime contractor and forwarded to the assigned contracting officer via encrypted email through the Department of Defense Safe (DoD SAFE) system or U.S. Postal Service, though this particular solicitation has marked that an OPSEC plan is NOT required as of the effective date of 3/11/26. Contractors and subcontractors bear responsibility for preventing inadvertent disclosure of classified or unclassified sensitive information throughout contract performance. The document identifies specific categories of protected information including personally identifiable information (PII), operation schedules, equipment capabilities and vulnerabilities, facility and asset identification, and photographs or videos from shipyard work areas. Contractors must implement countermeasures including prohibition of posting classified information to company websites or social media, use of NSA-approved shredders for document destruction, removal of identification badges upon departure, and immediate reporting of any unauthorized disclosures or suspected compromises to the unit sponsor, prime contract officer, and the Activity Security Manager. Violations may result in contract termination, removal of individual personnel, and criminal prosecution. The document also addresses Portable Electronic Device (PED) policies requiring coordination with sponsors prior to device use on shipyard premises.