問75
頻出度★★★
ISMSの「計画」，「運用」，「パフォーマンス評価」及び「改善」において，「パフォーマンス評価」で実施するものはどれか。
平成29年度 春期 ITパスポート試験 問75
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 75
Incorrectア
Information security risk assessment is the activity of identifying, analyzing, and evaluating risks and setting the policy for risk treatment; it belongs mainly to the “Plan” stage (and is also carried out during operation). It is not an activity of performance evaluation, so it is wrong.
- イ
正解 The correct answer is イ, “Internal audit.” An ISMS is run on the PDCA cycle, and the four items in the question correspond to “Plan,” “Operation (Do),” “Performance evaluation (Check),” and “Improvement (Act).” The “Performance evaluation” stage is the phase that checks and confirms whether the ISMS is functioning as intended; monitoring, measurement, analysis and evaluation, internal audit, and management review are all carried out here. Internal audit is an activity in which the organization itself verifies whether the ISMS conforms to the requirements and is operated effectively, which is exactly what performance evaluation covers, so it is correct.
Incorrectウ
Corrective action for nonconformity is the activity of removing the cause of a nonconformity found through audits and preventing its recurrence; it belongs to the “Improvement (Act)” stage. It is a follow-up step that fixes problems found during evaluation, not performance evaluation itself, so it is wrong.
Incorrectエ
Determination of risk (deciding, through risk assessment, which risks to treat) is an activity of the “Plan” stage, where policies and responses are planned. It is not carried out in performance evaluation, so it is wrong.
ここがポイント
- An ISMS is run on the PDCA cycle, corresponding to “Plan,” “Operation = Do,” “Performance evaluation = Check,” and “Improvement = Act.”
- In “Performance evaluation (Check),” monitoring, measurement, analysis and evaluation, internal audit, and management review are carried out to check whether the ISMS is functioning effectively.
用語