問61
頻出度★★★
PDCA モデルに基づいて ISMS を運用している組織において, 運用しているサーバのソフトウェアに対する最新の修正プログラムの有無を, 定められた運用手順に従って毎日調べる業務は, PDCA のどのフェーズか。
平成30年度 秋期 ITパスポート試験 問61
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 61
Incorrectア
The P (Plan) phase is where the ISMS policy and objectives are decided and the methods for responding to risks, as well as the operational procedures themselves, are formulated. In this question, the defined operational procedures already exist and are being executed, so it is not Plan, which is about creating procedures.
- イ
正解 The correct answer is イ (D, Do = operation and execution). In PDCA, the P (Plan) phase defines the information security policy, objectives, and operational procedures, while the D (Do) phase actually carries out day-to-day operation and execution according to those defined procedures. In this question, the task of checking every day whether the latest correction programs exist, following the defined operational procedures, simply executes as routine daily work the procedures already established in Plan, so it corresponds to the operational phase, D (Do).
Incorrectウ
The C (Check) phase is where the results of operation and the effectiveness of the entire ISMS are monitored and measured, and the degree of achievement of the objectives is evaluated through internal audits and management reviews. Because the verb check/investigate sounds like Check, it is easy to mistake this for Check, but this question describes routine daily operational work carried out exactly as per the defined procedures, not an inspection activity that evaluates the effectiveness of the ISMS.
Incorrectエ
The A (Act) phase is where, based on the inspection results from Check, deficiencies are corrected and the mechanism is reviewed for continual improvement. The routine daily operational work itself is not an improvement measure, so it does not apply.
ここがポイント
- The role of each PDCA phase: Plan = formulating policy and procedures; Do = operation and execution following the defined procedures; Check = monitoring and evaluating effectiveness (auditing); Act = correction and continual improvement.
- Routine daily work performed according to defined procedures is operation itself, so it is D (Do). Even though the verb is check/investigate, the key point is not to confuse it with the Check phase.
用語