In the OPSEC cycle, which step comes first?

• A. Analyze threats
• B. Identify critical information
• C. Analyze vulnerabilities
• D. Apply countermeasures

Answer: (B)

Identifying critical information is the starting point because it defines what needs protection. In OPSEC, you begin by pinpointing the specific data or details that, if exposed, could compromise operations or mission success. Knowing what’s critical sets the scope for everything that follows, allowing you to assess who might threaten that information, where it could be exposed, and what protections are needed. Once you’ve identified the critical items, you can analyze potential threats tied to them, evaluate where vulnerabilities might exist in how that information is handled, and then apply appropriate countermeasures to reduce risk.