問84
頻出度★★★
情報セキュリティマネジメントシステム (ISMS) では, “PDCA” のアプローチを採用している。D の段階で行うものはどれか。
平成23年度 特別試験 ITパスポート試験 問84
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 84
Incorrectア
“Periodically auditing the operation of the ISMS” belongs to the C (Check = monitoring and review) stage. Internal audits and effectiveness measurement check whether the results of operation match the plan and whether the controls are effective; they are not the execution itself. Audit results lead to the corrective actions of the next stage, A (Act = maintenance and improvement).
Incorrectイ
“Defining the basic policy of the ISMS” belongs to the P (Plan = establish) stage. The basic policy (the top level of the information security policy) is decided at the very beginning together with the scope and objectives of the ISMS, and it becomes the foundation for the later operation and checking. Drawing up a policy is planning, not execution.
- ウ
正解 In the ISMS PDCA cycle, D (Do) is the “implementation and operation” stage — the stage where the information security policy, the risk treatment policy, and the controls decided in P (Plan) are actually applied and kept running in the organization. Choice ウ, “conduct education and training for employees regarding ISMS operation,” is exactly such an operational activity: it enables the people on the front line to carry out the controls that have already been decided, so it is done in the D stage. Controls do not work just by being written in a document; they take effect only when people understand and practice them, so education and training is regarded as a representative Do-stage activity.
Incorrectエ
“Assessing risks and deciding which risks require countermeasures and their controls” is also part of the P (Plan) stage. Risk assessment (identification, analysis, and evaluation) and the selection of the risk treatment policy and controls are planning work that decides what will be done — the step that comes before D, where the chosen controls are put into action.
ここがポイント
- How the ISMS maps to PDCA: P = establish the ISMS (decide the basic policy and the scope, perform risk assessment and select controls); D = implement and operate (put the controls into practice, education and training, apply operating procedures); C = monitor and review (effectiveness measurement, internal audit, management review); A = maintain and improve (corrective and preventive actions).
- Sort the choices by their verb: “decide / plan” is P, “actually do it” is D, “check / audit” is C, and “fix / improve” is A. This lets you tell the choices apart quickly, and keeping the PDCA cycle turning is what leads to continual improvement.
用語