問91
頻出度★★★
ISMS適合性評価制度に関する次の記述中の a, b に入れる字句の適切な組合せはどれか。 企業などの組織において，[ a ] マネジメントシステムが適切に構築，運用され，ISMS 認証基準の要求事項に適合していることを [ b ] が審査して認証する制度である。
平成28年度 春期 ITパスポート試験 問91
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 91
Incorrectア
Blank a as personal information protection is wrong. It is the Privacy Mark scheme (PMS), not ISMS, that examines a personal information protection management system. Blank b as an internal audit department within the organization is also wrong, because an internal audit carried out by an in-house department is merely a self-conformity check and does not constitute an external certification.
Incorrectイ
Blank b as a specific third-party organization is correct, but blank a as personal information protection is wrong. ISMS targets information security, which protects the confidentiality, integrity, and availability of an organization's information assets in general, not only personal information. It is the Privacy Mark scheme that mainly targets personal information protection.
Incorrectウ
Blank a as information security is correct, but blank b as an internal audit department within the organization is wrong. The ISMS conformity assessment scheme is a certification scheme carried out by an independent third party, and an internal audit department cannot certify its own organization. Certification is performed by an external certification body that has no vested interest.
- エ
正解 ISMS stands for Information Security Management System, so blank a should be filled with information security. The ISMS conformity assessment scheme is a third-party certification mechanism in which a specific third-party organization (a certification body) that has no vested interest as a party involved objectively examines and certifies that the information security management system established and operated by an organization conforms to the requirements of the ISMS certification criteria (such as JIS Q 27001). Therefore blank b should be filled with a specific third-party organization, and the correct answer is combination エ: a = information security / b = a specific third-party organization.
ここがポイント
- ISMS = Information Security Management System. The ISMS conformity assessment scheme is a third-party certification scheme that assures an organization's information security management conforms to the ISMS certification criteria (JIS Q 27001).
- The key point is that certification is not done internally but by a specific third-party organization (a certification body) with no vested interest, which objectively examines and certifies. Also grasp the distinction from the Privacy Mark scheme, which targets personal information protection.
用語