問1
頻出度★★★
組織が経営戦略と情報システム戦略に基づいて情報システムの企画・開発・運用・保守を行うとき，そのライフサイクルの中で効果的な情報システム投資及びリスク低減のためのコントロールを適切に行うための実践規範はどれか。
平成27年度 春期 ITパスポート試験 問1
マネジメント系システム監査 › 内部統制
This question's explanation and your answers so far.
解説
問 1
Incorrectア
The Standards of Measures against Computer Unauthorized Access compile the security measures that system users, system administrators, network service providers, and others should take in order to prevent, detect, and recover from damage caused by unauthorized access from outside. Their scope is limited to security (countermeasures against unauthorized access); they are not a code of practice dealing with the effectiveness of information system investment or with controls across the whole life cycle.
Incorrectイ
The System Audit Standards define the code of conduct that a system auditor follows when performing an audit (auditor independence, audit planning, audit procedures, reporting, and other aspects of how audit work is done). They are standards for the side that audits, not a code of practice for the side that manages, so they do not fit the wording in the question: a code of practice for properly implementing controls when planning, developing, operating, and maintaining an information system. Remember them as a pair with the System Management Standards, and do not mix up which one is for the auditing side and which is for the managing side.
- ウ
正解 The correct answer is (ウ) System Management Standards. The System Management Standards are established as a code of practice for organizations that plan, develop, operate, and maintain information systems based on their management strategy and information system strategy: throughout the entire life cycle, such organizations should make effective information system investments and properly establish and operate controls that reduce risk. In other words, it is a yardstick of conduct for the side that manages the system (the audited side, the side that implements it), showing what should be managed and how. It directly matches all three keywords given in the question: the life cycle, effective information system investment, and controls for risk reduction. Also worth remembering: when a system audit is carried out, these standards are used as the criterion for judging what the controls ought to look like.
Incorrectエ
The Information System Safety Measures Standards present safety measures (measures relating to facilities, operations, and technology) for ensuring confidentiality, integrity, and availability against disasters, failures, deliberate interference, and the like affecting an information system. They focus on ensuring safety; they do not address the viewpoint of effective information system investment, nor are they positioned as a code of practice for controls across the whole life cycle.
ここがポイント
- System Management Standards = a code of practice for the managing side (the side that implements); System Audit Standards = a code of conduct for the auditing side (the system auditor). This division of roles between the pair is the most frequently tested point of distinction, and in a system audit the System Management Standards serve as the criterion for judging what the controls ought to be.
- The keywords for the System Management Standards are: the information system life cycle (planning, development, operation, maintenance), effective information system investment, and controls for risk reduction. When these three appear in a question, choose the System Management Standards.
用語