In the OPSEC cycle, which step comes second?

• A. Identify critical information
• B. Apply countermeasures
• C. Analyze threats
• D. Analyze vulnerabilities

Answer: (C)

In the OPSEC cycle, after you identify the information that needs protection, the next step is to analyze threats—really looking at who might target that information, what they are capable of, and their intent to obtain or misuse it. This clarifies whether there are adversaries and what methods they might use, which then shapes how you look for weaknesses. Understanding threats first helps you focus the subsequent vulnerability analysis on the areas most at risk, so you can see where gaps exist that a thief or leak could exploit. After identifying threats, you would assess vulnerabilities to see where those threats could actually succeed, then decide on countermeasures based on the overall risk. For example, if the critical information is deployment schedules, analyzing threats would involve considering potential adversaries who would benefit from knowing those dates and what they could do to acquire them.