N39040Q6134V600 Attachment 2 OPSEC_Redacted.pdf

This document is the Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements guidance for contractors.

The guidance establishes OPSEC as a process to protect sensitive information, including Critical Information and Indicators (CII), from unauthorized disclosure by adversaries. An OPSEC Plan is required in some instances but is not required for this particular contract, as indicated by the checked box on the form. All contractors and subcontractors are responsible for protecting both classified and unclassified sensitive information throughout contract performance. The document prohibits disclosure of Controlled Unclassified Information (CUI) and Personal Identifiable Information (PII) through corporate communications, newsletters, social media, or personal email accounts. Unauthorized disclosure may result in contract termination, criminal prosecution, and civil penalties.

The guidance identifies critical information requiring protection, including personally identifiable information, operation and maintenance schedules, equipment capabilities and vulnerabilities, facility and infrastructure identification, and photographs or videos taken within shipyard work areas. Contractors must implement countermeasures including: restricting verbal discussion of shipyard-related work, shredding sensitive documents using NSA-approved methods, refraining from posting shipyard information on social media, removing and returning all access badges upon contract completion, and immediately reporting unauthorized disclosures to the unit sponsor, prime contract officer, and the Activity Security Manager. Portable electronic devices used on-site require advance coordination with the contract sponsor for security approval.