問58
頻出度★★★
情報セキュリティマネジメントシステム (ISMS) の PDCA (計画・実行・点検・処置) において, 処置フェーズで実施するものはどれか。
平成22年度 秋期 ITパスポート試験 問58
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 58
- ア
正解 The correct answer is ア, “Maintenance and improvement of the ISMS.” JIS Q 27001 requires an ISMS to be operated continuously through the PDCA cycle, and each phase is defined as Plan = establishment of the ISMS, Do = introduction and operation of the ISMS, Check = monitoring and review of the ISMS, and Act = maintenance and improvement of the ISMS. The handling phase asked about in the question corresponds to A (Act) of PDCA: acting on the nonconformities found in Check and on the results of audits and reviews by carrying out corrective and preventive actions, and improving the ISMS itself while maintaining it. What is therefore carried out in Act is “maintenance and improvement of the ISMS,” so ア is correct.
Incorrectイ
“Establishment of the ISMS” is what is carried out in the P (Plan) phase of PDCA. It covers the activities that build the framework of the ISMS — deciding the scope, drawing up the basic information security policy, performing risk assessment and deciding the risk treatment policy — and is not the handling phase.
Incorrectウ
“Monitoring and review of the ISMS” is what is carried out in the C (Check) phase of PDCA. It is the stage where effectiveness is evaluated through monitoring and measuring how the system is operating, internal audits, and management reviews, and it is distinct from the handling phase, where action is taken in response to those evaluation results.
Incorrectエ
“Introduction and operation of the ISMS” is what is carried out in the D (Do) phase of PDCA. It is the stage where the controls decided in Plan are actually put in place and run from day to day, including education and training, and it is not the handling phase.
ここがポイント
- The four phases of the ISMS PDCA cycle map to fixed wording: Plan = establishment of the ISMS / Do = introduction and operation of the ISMS / Check = monitoring and review of the ISMS / Act = maintenance and improvement of the ISMS. Memorize this table as it stands and you can sort the choices out immediately.
- The essence of the Act (handling) phase is continual improvement. What is tested is that corrective and preventive actions are taken for the nonconformities detected in Check, and that the results are fed back into the next Plan so the cycle keeps turning.
用語