問68
頻出度★★★
1年前に作成した情報セキュリティポリシについて, 適切に運用されていることを確認するための監査を行った。この活動は PDCA サイクルのどれに該当するか。
令和元年度 秋期 ITパスポート試験 問68
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 68
Incorrectア
P (Plan) is the planning stage of newly drafting and establishing the information security policy, objectives, and countermeasures. This question deals with a confirmation activity targeting a policy already created one year ago, not the creation of a new plan, so it does not apply.
Incorrectイ
D (Do) is the execution stage where the planned policy and countermeasures are actually introduced and operated. The audit in this question is not the operation itself but an activity that confirms from the outside whether the operation is appropriate, so it does not apply.
- ウ
正解 The PDCA cycle is a framework for continual improvement that repeats four stages: Plan → Do → Check (inspection and evaluation) → Act (improvement). In this question, the audit conducted to confirm whether an information security policy created one year ago is being operated appropriately is exactly the activity of inspecting and evaluating whether the operation (= Do) is being carried out as planned. This stage of confirming and evaluating the results of execution corresponds to Check, so choice ウ, which represents C, is correct.
Incorrectエ
A (Act) is the stage of correcting and improving the policy and operation based on the problems found in Check. This question only goes as far as the stage of confirming whether it is operated appropriately, and improvement measures based on the confirmation results have not yet been taken, so it does not apply.
ここがポイント
- PDCA cycle: a framework for continual improvement that repeats Plan → Do → Check (inspection and evaluation) → Act (improvement).
- An audit that confirms and evaluates the operational status is positioned in the Check (C) stage.
用語