ISC2 ISSMP Exam - Topic 3 Question 35 Discussion

OPSEC is also known as operations security. It has three laws.

The First Law of OPSEC. If you don't know the threat, how do you know what to protect? Although specific threats may vary from site to site or program to program. Employees must be aware of the actual and postulated threats. In any given situation, there is likely to be more than one adversary, although each may be interested in different information.

The Second Law of OPSEC. If you don't know what to protect, how do you know you are protecting it? The 'what' is the critical and sensitive, or target, information that adversaries require to meet their objectives.

The Third Law of OPSEC. If you are not protecting it (the critical and sensitive information), the adversary wins! OPSEC vulnerability assessments, (referred to as 'OPSEC assessments' - OA's - or sometimes as Surveys') are conducted to determine whether or not critical information is vulnerable to exploitation. An OA is a critical analysis of 'what we do' and 'how we do it' from the perspective of

an adversary. Internal procedures and information sources are also reviewed to determine whether there is an inadvertent release of sensitive information.

Answer option D is incorrect. The statement given in the option is not a valid law of OPSEC.