N39040Q6189V257_Attachment 3_2 PNSY OPSEC Contract Requirements1_Redacted.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements form that outlines security obligations and information protection protocols for contractors and subcontractors.

The form establishes that contractors must implement an OPSEC Plan to protect sensitive information from unauthorized disclosure, whether classified or unclassified. An OPSEC Plan must be signed by the Prime Contractor and forwarded to the assigned contracting official via encrypted email through the Department of Defense Safe (DoD SAFE) system or U.S. Postal Service. The form indicates that an OPSEC Plan is NOT required for this particular contract. Contractors and all personnel are responsible for preventing inadvertent disclosure of unclassified and classified information during contract performance and must protect Controlled Unclassified Information (CUI) and Critical Information and Indicators (CII) according to applicable regulations and policies.

The document identifies specific categories of critical information and indicators that require protection, including Personally Identifiable Information (PII), operation and repair schedules, equipment capabilities and vulnerabilities, facility and infrastructure identification, and photographs or videos taken within shipyard work areas. Contractors must establish countermeasures including prohibitions on posting sensitive information to corporate websites, social media, or public newsletters; mandatory shredding of shipyard documents using NSA-approved methods; removal and return of badges and access credentials upon contract completion; and immediate reporting of any unauthorized disclosures or suspected compromises of critical information to the unit sponsor, prime contract officer, and Activity Security Manager.