令和2年度 ITパスポート試験問68

This question's explanation and your answers so far.

問68

頻出度★★★

リスク対応を, 移転, 回避, 低減及び保有に分類するとき, 次の対応はどれに分類されるか。〔対応〕職場における机上の書類からの情報漏えい対策として, 退社時のクリアデスクを導入した。

出典　令和2年度 ITパスポート試験問68

解説

問 68

Incorrectア
Transfer means shifting the loss or the responsibility for handling a risk to a third party, such as taking out insurance or outsourcing. A clear-desk policy is only an in-house practice that lowers the leakage probability and does not move the risk outside the organization, so it is wrong.
Incorrectイ
Avoidance means stopping the very activity that causes the risk, cutting the risk off at its root (e.g., placing no paper documents on desks at all, or abolishing paper-based work). A clear-desk policy keeps document work going while lowering the probability with a control, so it is not avoidance and is wrong.
ウ
正解 A clear-desk policy (the practice of clearing documents off the desk when leaving the office) is a control that reduces the chance of documents left on a desk being seen or taken away by a third party. Lowering a risk’s likelihood or impact so that it stays within an acceptable range is treated as reduction, so the correct answer is ウ. It does not abolish document work itself, so it is not avoidance; the key point is that it merely shrinks the existing risk.
Incorrectエ
Retention (acceptance) means accepting a risk as it is without taking any special measures, for reasons such as the risk being small. Since an active measure like a clear-desk policy is being carried out, it does not count as no-measure retention, so it is wrong.

ここがポイント

The four categories of risk treatment: transfer (shifting to a third party), avoidance (cutting off the risk source), reduction (making the likelihood or impact smaller), and retention (accepting without measures).
A clear-desk policy is a typical example of lowering a risk’s likelihood with a control, so it is classified as reduction.

用語

解答問68ウ