問63
頻出度★★★
情報セキュリティのリスクマネジメントをリスク特定, リスク分析, リスク評価, リスク対応に分けたときに, リスク対応に含まれるものはどれか。
平成29年度 春期 ITパスポート試験 問63
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 63
Incorrectア
“Identify and enumerate the risks that exist in the organization” is the work of finding out where and what risks exist; it corresponds to “risk identification,” the first stage of risk management, not to risk treatment.
Incorrectイ
“Compare the magnitude of a risk with the risk acceptance criteria to judge whether countermeasures need to be implemented” is the stage of judging whether the assessed magnitude of a risk is at an acceptable level; it corresponds to “risk evaluation,” not the stage of deciding how to treat the risk.
Incorrectウ
“Estimate the magnitude of a risk from its probability of occurrence and degree of impact” is the work of estimating how serious a risk is; it corresponds to “risk analysis.” It is still the stage of expressing the magnitude as a number or level, which differs from risk treatment, where a method of dealing with the risk is chosen.
- エ
正解 Risk management proceeds by first grasping the magnitude of the risks uncovered through “risk identification → risk analysis → risk evaluation” (these three steps together are called risk assessment), and finally, in “risk treatment,” deciding how to handle those risks and taking action. Choice エ, “select a method for dealing with a risk and draw up a plan of specific management measures (controls),” is exactly the act of deciding how to handle a risk (choosing a policy among avoidance, reduction, transfer, retention, etc.) and planning the controls to do so — it is risk treatment itself. Therefore エ is correct.
ここがポイント
- The flow of risk management: risk identification (uncovering risks) → risk analysis (computing magnitude from probability × impact) → risk evaluation (comparing with acceptance criteria to judge whether countermeasures are needed) → risk treatment (choosing a method of handling and planning controls). The first three stages together are called risk assessment.
- Remember that risk treatment is the stage of choosing a policy for handling a risk (avoidance, reduction, transfer, retention, etc.) and planning and implementing specific controls — distinguish it from analysis and evaluation.
用語