While the protective techniques include all security disciplines, primary emphasis is given to the role of policies, practices, and procedures in protecting critical information. Because of the procedural nature of OPSEC, responsibility for implementation and operation rests with senior management. In reducing the threat represented by hostile national or corporate intelligence systems, the first step involves a self-assessment that includes identifying adversaries, their objectives, and the information they need to attain their objectives. Management must stipulate this information so that security can be tailored to meet specific needs. The size of the OPSEC response should be based on a cost/benefit analysis, and the response should be formalized in the firm's standard operating procedures. An OPSEC master plan should be developed that details the who, what, when, where, and why of the program's key elements. Once this is done, the organization is ready to implement the plan. First, the self-assessment should be validated to ensure that all threats and vulnerabilities were properly identified. Surveys can be conducted to identify the program's hazards and shortcomings. An outside consultant can be used to objectively evaluate the firm's internal efforts. A monitoring process should be developed to provide objective oversight and minimize illegal or unethical activities.