In the sequence of the 5 Step OPSEC Process, which step follows 'Analyze threats'?

• A. Identify critical information
• B. Analyze threats
• C. Analyze vulnerabilities
• D. Assess risks

Answer: (C)

The sequence tests how exposure is uncovered by first pinpointing what information is critical, then considering who or what might threaten it, and then identifying exactly where those threats could exploit weaknesses. After analyzing threats, the logical next step is to analyze vulnerabilities — zero in on weaknesses in processes, systems, or people that could be exploited to access the critical information. This vulnerability analysis clarifies where gaps exist so you can properly assess overall risk: how likely it is that a threat would exploit a vulnerability and what impact that would have. Only after understanding vulnerabilities do you move to assessing risks and then applying countermeasures.

So, identifying critical information occurs earlier, threat analysis follows, and vulnerability analysis comes next, with risk assessment after that, and countermeasures last.