問1
頻出度★★★
リスクアセスメントを三つのプロセスに分けるとすると, リスクの特定, リスクの評価ともう一つはどれか。
平成31年度 春期 ITパスポート試験 問1
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 1
Incorrectア
Risk transfer is a technique for shifting risk to a third party through means such as taking out insurance or outsourcing operations, and it is classified as risk response (risk treatment). It is not included among the three assessment processes that estimate the magnitude of risk.
Incorrectイ
Risk avoidance is a technique that eliminates risk factors by stopping the risk-generating activity itself, and this too is a form of risk response. It is a countermeasure chosen in the stage after assessment (identification, analysis, evaluation), and is not a component of assessment.
Incorrectウ
Risk reduction is a technique for lowering the probability of occurrence or the impact by taking countermeasures, and it likewise belongs to risk response. It is not a step for estimating risk but a measure taken after evaluation, so it does not fall under the three assessment processes.
- エ
正解 Risk assessment is a series of activities within risk management that identify and estimate risks, and it consists of three processes: risk identification, risk analysis, and risk evaluation. Since the question already lists risk identification and risk evaluation, the remaining one is risk analysis = エ. Risk analysis is the step of estimating the probability of occurrence and the magnitude of impact for identified risks and clarifying the magnitude of the risk (its risk level); its results are then used in the next evaluation step to judge whether a response is needed and its priority.
ここがポイント
- Risk assessment = the three processes of risk identification → risk analysis → risk evaluation (JIS Q 31000). Analysis estimates the magnitude of risk, and evaluation judges whether a response is needed and its priority.
- Transfer, avoidance, and reduction (as well as acceptance) are options of risk response (risk treatment), which is a stage separate from assessment. This distinction is the key point tested by this question.
用語