問57
頻出度★★★
ISMS における情報セキュリティリスクの取扱いに関する“リスク及び機会に対処する活動”には, リスク対応, リスク評価, リスク分析が含まれる。この活動の流れとして, 適切なものはどれか。
平成29年度 秋期 ITパスポート試験 問57
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 57
Incorrectア
“Risk treatment → Risk evaluation → Risk analysis” has the order reversed. You cannot decide on risk treatment measures at a stage where neither analysis nor evaluation has been done. Treatment is the final step, carried out after analysis and evaluation.
Incorrectイ
“Risk evaluation → Risk analysis → Risk treatment” has analysis and evaluation swapped. Risk evaluation is the step that compares the magnitude estimated in risk analysis against the risk criteria, so risk analysis must always come first.
Incorrectウ
“Risk analysis → Risk treatment → Risk evaluation” has evaluation and treatment in the wrong order. You should first decide in risk evaluation whether treatment is needed and its priority, and only then move on to risk treatment; you cannot skip evaluation and treat the risk first.
- エ
正解 The correct answer is エ “Risk analysis → Risk evaluation → Risk treatment”. In the risk management of an ISMS (JIS Q 27001), you first carry out a risk assessment, and based on its results you then perform risk treatment. A risk assessment proceeds in the order “Risk identification → Risk analysis → Risk evaluation”: in risk analysis you estimate the magnitude of the risk (the likelihood of occurrence and the size of the consequences), and in risk evaluation you compare that analysis result against the risk criteria to decide whether treatment is needed and its priority. Only once that decision is fixed do you take risk treatment measures such as acceptance, reduction, avoidance, or transfer. Therefore the flow is “Risk analysis → Risk evaluation → Risk treatment”, so エ is appropriate.
ここがポイント
- The overall framework of risk management is “risk assessment → risk treatment”, and the risk assessment consists of “risk identification → risk analysis → risk evaluation” (JIS Q 27001 / ISO 31000).
- Remember the order: risk analysis (estimate the magnitude of the risk) → risk evaluation (compare against the criteria to judge whether treatment is needed and its priority) → risk treatment (measures such as acceptance, reduction, avoidance, or transfer).
用語