問69
頻出度★★★
PDCAモデルに基づいてISMSを運用している組織において，始業時の手順に従って業務用PCに適用されていないセキュリティパッチの有無を確認し，必要なパッチを適用している。この活動はPDCAサイクルのうちどれに該当するか。
平成27年度 秋期 ITパスポート試験 問69
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 69
Incorrectア
P (Plan) is the phase of formulating the information security policy, performing risk assessment, and designing the controls and operating procedures to be applied. In the question the staff execute already-defined procedures, so it is not the planning phase.
- イ
正解 The Do (implementation) phase of the PDCA cycle is where the information security policy, plans, and controls formulated in the Plan phase are actually put into place and run on a day-to-day basis. In the question, the activity of following the start-of-work procedure to check whether any security patches are unapplied on the business PCs and then applying the necessary patches is routine operation that steadily carries out predefined operating procedures, which is exactly Do. Therefore choice イ (D) is correct. Note that the “check” here is part of the operating procedure and differs from the Check phase, which evaluates the effectiveness of the ISMS.
Incorrectウ
C (Check) is the phase of evaluating whether the ISMS is functioning as planned, through monitoring and measuring operational results, internal audits, and management reviews. The “check” in the question is part of the daily operating procedure, not an inspection activity that evaluates the effectiveness of the whole ISMS.
Incorrectエ
A (Act) is the phase of taking corrective and preventive actions based on the Check results to continually improve the ISMS. The question is not a scenario of evaluating a problem and then taking improvement measures, but the execution of predefined procedures itself, so it does not apply.
ここがポイント
- PDCA cycle: distinguish the 4 phases — Plan (formulate policy and plans) → Do (implement and operate day-to-day) → Check (monitor, audit, review) → Act (correct and continually improve).
- Daily activities that execute predefined operating procedures (such as applying patches) are Do. Do not confuse the “check” work within the procedure with the Check phase that evaluates the effectiveness of the ISMS.
用語