問56
頻出度★★★
次の作業a～dのうち, リスクマネジメントにおける, リスクアセスメントに含まれるものだけを全て挙げたものはどれか。 a リスク特定 b リスク分析 c リスク評価 d リスク対応
令和元年度 秋期 ITパスポート試験 問56
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 56
Incorrectア
This includes only a (risk identification) and b (risk analysis), leaving out c (risk evaluation). Evaluation is also part of risk assessment, so this is incomplete and incorrect.
- イ
正解 In the risk management standard (JIS Q 31000 / ISO 31000), risk assessment refers to the three steps of risk identification (a) → risk analysis (b) → risk evaluation (c). That is, you first identify where and what kinds of risks exist (identification), then estimate their magnitude (likelihood and impact) (analysis), and finally decide whether treatment is needed by comparing them against criteria (evaluation); everything up to this point is assessment. Risk treatment (d) is a separate, subsequent step in which you actually select and carry out measures based on the evaluation results, so it is not included. Therefore, option イ, which lists a, b, and c, is correct.
Incorrectウ
b (risk analysis) and c (risk evaluation) are correct, but this also includes d (risk treatment). Risk treatment is a step that comes after assessment, and this option also omits a (risk identification), so it is incorrect.
Incorrectエ
The combination of c (risk evaluation) and d (risk treatment). d is not included in assessment, and a (risk identification) and b (risk analysis) are also missing, so it is incorrect.
ここがポイント
- Risk assessment = the three steps of risk identification + risk analysis + risk evaluation (JIS Q 31000 / ISO 31000).
- Risk treatment (selecting and carrying out measures to avoid, reduce, transfer, or accept risk) is a separate step positioned after assessment and is not included in assessment.
用語