問50
頻出度★★★
ある事業者において, 情報資産のライフサイクルに従って実施される情報セキュリティ監査を行うことになった。この対象として, 最も適切なものはどれか。
平成31年度 春期 ITパスポート試験 問50
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 50
Incorrectア
This limits the audit target to the mechanism called an “information system”. What should be protected along the lifecycle is the information assets themselves; paper media, verbal information, and the like that are not held in information systems would be left out of scope, so this is inappropriate.
Incorrectイ
This narrows the scope to only the information assets held outside of information systems (such as paper documents), leaving out the electronic data inside information systems. It can cover only a part of all the assets held, so it is inappropriate.
Incorrectウ
This narrows the scope to only the information assets held inside information systems, so conversely, information assets outside the system such as paper media and information handled verbally are left out of scope. This too remains only a part, so it is inappropriate.
- エ
正解 Information assets are not limited to the electronic data inside information systems; they also include paper documents, recording media, knowledge passed on verbally, and any other information that the organization values and holds. Because information carries a risk of leakage or tampering no matter which stage or form it is in, an information security audit conducted according to the lifecycle of information assets (acquisition/creation → use → storage → disposal) is most appropriately targeted at all information assets that are held. Therefore エ is the correct answer.
ここがポイント
- Information assets include not only electronic data but all forms such as paper media, recording media, and people's knowledge. An information security audit targets all the information assets that are held.
- Risks arise at each stage of the information asset lifecycle (acquisition/creation → use → storage → disposal), so the audit is not limited to a particular storage location or form.
用語