問75
頻出度★★★
ISMSの運用において, 監査結果をインプットとし, ISMSを継続的に改善するための是正処置及び予防処置を行うプロセスはPDCAサイクルのどれにあたるか。
平成27年度 春期 ITパスポート試験 問75
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 75
Incorrectア
P (Plan) is the phase where the ISMS is «planned and established»: setting the information security policy, defining the scope, performing risk assessment and deciding the risk treatment approach, selecting controls, and so on. It is not the phase where action is taken based on audit results.
Incorrectイ
D (Do) is the phase where the policy and controls decided in Plan are actually «implemented and operated», centering on training and carrying out day-to-day operating procedures. Corrective and preventive actions based on audit results are not Do; they are the role of Act.
Incorrectウ
C (Check) is the phase where the operation of the ISMS is «monitored, measured, and reviewed», evaluating effectiveness through internal audits and management reviews. Performing the audit and obtaining its results is as far as Check goes; using those results to carry out corrective and preventive actions belongs to the next phase, Act.
- エ
正解 The correct answer is エ (A = Act). An ISMS (Information Security Management System) is run through the PDCA cycle: in Plan you set the policy, carry out risk assessment, and plan the controls; in Do you introduce and operate the planned controls; in Check you verify effectiveness through monitoring, measurement, and internal audit; and in Act you carry out corrective and preventive actions based on the results of that checking and auditing. The question asks about the process that «takes audit results as input» and «performs corrective and preventive actions for continual improvement», which is exactly the Act (improve / take action) phase. The key point is the division of roles: «performing the audit» is Check, while «acting on the problems found in the audit and turning them into improvement» is Act.
ここがポイント
- PDCA for an ISMS: Plan = set the policy, do risk assessment, select controls; Do = implement and operate the controls; Check = verify effectiveness through monitoring, measurement, and internal audit; Act = achieve continual improvement through corrective and preventive actions based on the audit results.
- «Performing the audit» is Check; «taking corrective and preventive actions based on the audit results» is Act. That boundary is exactly what this question tests, and whenever the keyword «continual improvement» appears, think of Act.
用語