N39040Q6189V257_Attachment 3_ 2PNSY OPSEC Contract Requirements1_Redacted.pdf

This document is a Portsmouth Naval Shipyard Operations Security (OPSEC) Contract Requirements form that must be attached with solicitation and award documentation.

The document establishes OPSEC requirements to protect sensitive information from unauthorized disclosure during contract performance. OPSEC is defined as a process to safeguard Critical Information and Indicators (CII), which includes both classified and unclassified sensitive information. Contractors and subcontractors must sign an OPSEC Plan, which is required to be submitted by the Prime contractor and forwarded to the assigned contracting officer via encrypted email through the Department of Defense Safe (DoD SAFE) or U.S. Postal Service. The form includes a checkbox indicating that an OPSEC Plan is NOT required for this particular contract, though consideration may be given based on work type, environment, and circumstances.

Contractors bear full responsibility for preventing inadvertent disclosure of unclassified or classified information. The document specifies that Controlled Unclassified Information (CUI) cannot be distributed to unauthorized third parties, published in corporate communications, posted on social media, or transmitted through personal email accounts. Critical Information and Indicators include personally identifiable information, operational schedules, equipment capabilities, facility and infrastructure details, and photographs or videos taken in shipyard work areas. Countermeasures require contractors to restrict verbal discussion of shipyard work, shred sensitive documents using NSA-approved methods, remove badges upon departure, and immediately report any suspected compromises to the unit sponsor, prime contract officer, and the Activity Security Manager. Violations may result in contract removal, termination, criminal prosecution, and civil penalties.