問57
頻出度★★★
ISMS を運用している組織において, 退職者が利用していた ID を月末にまとめて削除していたことについて, 監査で指摘を受けた。これを是正して退職の都度削除するように改めるのは, ISMS の PDCA サイクルのどれに該当するか。
平成25年度 秋期 ITパスポート試験 問57
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 57
Incorrectア
P (Plan) is the stage where the information security policy, the scope, the risk assessment policy, the controls and the operating procedures are established in advance. The action in this question is a correction made after receiving the check result of an audit finding, not a situation of drawing up a plan from scratch, so it is not Plan.
Incorrectイ
D (Do) is the stage of operating and implementing the procedures and controls decided in Plan exactly as defined, including training and record keeping. The former practice of deleting IDs together at the end of the month is itself what corresponds to Do; reviewing and changing that way of operating is not Do.
Incorrectウ
C (Check) is the stage of monitoring and measuring how the system is operating and evaluating its effectiveness through internal audits and management reviews. In this question, everything up to “the audit pointed out the problem” is Check, but what is being asked about is the action of changing the operation afterwards, so it is not Check.
- エ
正解 The ISMS PDCA cycle runs in the order Plan (planning: establishing policies, objectives and procedures) → Do (operation: carrying things out as planned) → Check (checking: monitoring, measuring, auditing and reviewing) → Act (improvement: corrective action and continual improvement based on the results of checking). In this question, everything up to the point where “the audit pointed out the problem” is Check; changing the inappropriate practice of “deleting all IDs together at the end of the month” into “deleting each ID whenever the person leaves” in response to that finding is exactly the corrective action that removes a nonconformity found by checking. Corrective action and continual improvement are Act activities, so choice エ, which stands for “A”, is correct.
ここがポイント
- ISMS PDCA: Plan = drawing up the plan, Do = operation and implementation, Check = monitoring, measuring and internal auditing, Act = corrective action and continual improvement. Decide which stage applies from the purpose of the action.
- Corrective action taken against a nonconformity found in an audit or review, together with measures to prevent recurrence, is classified as Act (continual improvement). Remember them separately: the audit itself is Check, while the improvement made after the audit is Act.
用語