What is the first step in the 5 Step OPSEC Process?

• A. Identify critical information
• B. Analyze threats
• C. Analyze vulnerabilities
• D. Assess risks

Answer: (A)

The first step in the OPSEC process is identifying the critical information that needs protection. Knowing what information is critical sets the scope for everything that follows—if you don’t define what needs protection, you can’t accurately assess threats, recognize vulnerabilities, or determine the level of risk. Once you’ve pinpointed CI, you can map out who might threaten it, how it could be exposed through weaknesses in processes or systems, and what risk remains, so you can select effective countermeasures. For example, if sensitive data like login credentials or project schedules are identified as critical, the subsequent steps focus specifically on threats to that data and on the vulnerabilities that could let it be accessed or leaked, guiding targeted protections.