What type of approach is PAP?

• A. Linear, One-Step Approach
• B. Static, Single-Method Approach
• C. Multi-Process Iterative Approach
• D. Reactive, Crisis-Driven Approach

Answer: (C)

PAP is built as a risk-based program that is never a one-and-done task. It uses a set of interrelated processes—risk assessment, asset identification, threat and vulnerability analysis, design and selection of protections, implementation, testing, monitoring, and ongoing refinement. Because threats evolve and assets change, the protection approach must loop through these activities repeatedly, adjusting controls as new information becomes available. This multi-process, iterative nature keeps the program dynamic and capable of continual improvement, rather than fixed or reactive.

Choosing a linear, one-step approach isn’t fitting because it would stop adapting once initial steps are completed. A static, single-method approach also falls short because it doesn’t account for changing conditions or feedback from monitoring. A reactive, crisis-driven approach only responds after incidents occur, whereas PAP emphasizes proactive planning and ongoing enhancement before problems arise.