In the OPSEC cycle, which step comes fourth?

• A. Identify critical information
• B. Analyze threats
• C. Analyze vulnerabilities
• D. Apply countermeasures

Answer: (D)

The main idea is that risk reduction comes after you’ve mapped out what needs protection, who might threaten it, and where the weaknesses lie. You start by identifying critical information—the assets at risk. Then you analyze threats to understand who could exploit those assets and how. Next you analyze vulnerabilities to see where defenses are weak. Only after you have a clear picture of the risk landscape do you apply countermeasures to reduce that risk. Applying countermeasures means putting protective actions in place—policies, procedures, access controls, physical security, encryption, training, etc.—to mitigate the identified vulnerabilities. After implementing them, you monitor and adjust to ensure they’re effective.