問63
頻出度★★★
PDCA モデルに基づいて ISMS を運用している組織において, A (Act) で実施することの例として, 適切なものはどれか。
平成31年度 春期 ITパスポート試験 問63
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 63
- ア
正解 In the PDCA cycle, A (Act = action/improvement) is the phase where the system is corrected and improved in response to problems found in C (Check). Option ア says “change the server monitoring method as a corrective action based on the audit (Check) results”, which is precisely the act of revising operations based on deficiencies found during inspection, so it is an appropriate example of A (Act).
Incorrectイ
Having a third party objectively evaluate the server administrator's work is the act of inspecting and auditing the operational status to confirm its effectiveness, which corresponds to C (Check), not A.
Incorrectウ
Identifying and listing the information assets in the server room is preparation for assessing risks and drawing up the ISMS plan, which corresponds to P (Plan), not the improvement phase A.
Incorrectエ
Monitoring the server's operation according to the established operating procedures is the act of implementing and operating the ISMS as planned, which corresponds to D (Do), not A.
ここがポイント
- The PDCA of an ISMS: P = establishing the policy, assessing risks, and identifying assets; D = operating and monitoring according to procedures; C = inspection through audits or third-party evaluation; A = corrective action and continual improvement based on inspection results.
- The key to A (Act) is “fixing the system in response to the Check results = corrective action and improvement”. Mere operation or inspection itself is not A.
用語