What is the fifth step of the OPSEC Process?

• A. Apply OPSEC Countermeasures
• B. Identify Critical Information
• C. Analyze Vulnerabilities
• D. Analyze Threats

Answer: (A)

The fifth step is applying OPSEC countermeasures. After identifying what information is critical, analyzing the threats, examining vulnerabilities, and assessing risk, the natural next move is to implement protections that reduce exposure and hinder adversaries from exploiting weaknesses. Countermeasures can be procedural changes, technical controls, or physical safeguards—things like restricting access to sensitive data, changing routines to avoid predictable patterns, improving communications security, training personnel, and monitoring for leaks. Putting these controls in place lowers the remaining risk (the residual risk) and creates a basis for ongoing evaluation, since the effectiveness of protections should be reviewed and adjusted as conditions change. The earlier steps tell you what to protect and where risks lie; the countermeasures do the actual work of reducing that risk.