問62
頻出度★★★
情報セキュリティマネジメントシステム (ISMS) の PDCA (計画・実行・点検・処置) において, 点検フェーズで実施するものはどれか。
平成24年度 春期 ITパスポート試験 問62
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 62
Incorrectア
“Maintenance and improvement of the ISMS” is an activity of the Act phase. It is the stage where corrective and preventive actions are taken against the nonconformities and weaknesses found during the Check phase, and the improved ISMS is handed over to the next cycle; it is not the Check phase itself. It is a later step that acts on the results evaluated in Check, so in the sequence it also comes after Check.
Incorrectイ
“Establishment of the ISMS” is an activity of the Plan phase. It corresponds to designing the ISMS: deciding the scope, setting the information security policy, carrying out a risk assessment, and choosing the risk treatment approach and the controls. It is the starting point of the cycle, and since there is no operational track record yet, there is not even anything to monitor or evaluate.
- ウ
正解 An ISMS is a mechanism that improves continually by running the PDCA cycle, and the standard clearly assigns what has to be done in each phase. The Check phase is the stage for measuring and confirming whether implementation and operation are going as planned and whether the information security objectives that were set are being achieved; concretely it covers activities such as monitoring the operational status, measuring effectiveness, internal audits, and management reviews. Choice ウ, “Monitoring and review of the ISMS,” is exactly this content, so ウ is correct. The key point is that the Check phase is not a stage for building or fixing something new, but a stage for evaluating the current situation and gathering the material that feeds into the next phase, Act.
Incorrectエ
“Implementation and operation of the ISMS” is an activity of the Do phase. It is the stage where the controls chosen in Plan are actually put in place, procedures are operated, employees are trained, and resources are allocated so that the ISMS really runs. What the Check phase measures afterwards is precisely the operational track record produced here, so Do and Check are separate phases.
ここがポイント
- The PDCA mapping of an ISMS is something to memorize: Plan = establishment of the ISMS, Do = implementation and operation of the ISMS, Check = monitoring and review of the ISMS, Act = maintenance and improvement of the ISMS. The wording of the choices corresponds one to one with the wording used in the standard.
- What the Check phase contains are evaluation activities such as monitoring the operational status, measuring effectiveness, internal audits, and management reviews, while actually carrying out improvements belongs to the next phase, Act. Not confusing evaluation with the execution of improvements is what separates right from wrong here.
用語