問69
頻出度★★★
ISMS の確立, 実施, 維持及び継続的改善における次の実施項目のうち, 最初に行うものはどれか。
令和2年度 ITパスポート試験 問69
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 69
Incorrectア
Information security risk assessment is an activity carried out in Clause 6 on planning, and it presupposes grasping the needs of interested parties and determining the scope. Because it is a stage that comes after the foundation is in place, it is not the first.
Incorrectイ
Information security risk treatment is carried out based on the risks identified and evaluated in risk assessment (ア). It is a stage later than ア, so it is not what is performed first.
Incorrectウ
Internal audit is located in Clause 9 on performance evaluation, and it is carried out to confirm the effectiveness and conformity of the ISMS after it has actually been operated. It corresponds to the Check phase of PDCA, a later-half activity, so it is not the first.
- エ
正解 The correct answer is エ, understanding the needs and expectations of interested parties. In JIS Q 27001 (ISO/IEC 27001), which defines the ISMS, you first carry out 4.2 within Clause 4 on understanding the organization and its context, grasping what the parties surrounding the organization (customers, business partners, employees, regulatory authorities, and so on) require regarding information security. This determines the scope of the ISMS and the requirements it must meet, and it becomes the foundation for the later activities such as risk assessment, risk treatment, operation, and internal audit. Therefore, among the choices, the one performed first is エ.
ここがポイント
- The implementation order of an ISMS (JIS Q 27001): understanding the needs of interested parties → determining the scope → risk assessment → risk treatment → operation → internal audit → continual improvement. Grasping the organization's context is the starting point for everything.
- Keep in mind that risk assessment and risk treatment are activities of the planning stage, while internal audit is an activity of the evaluation stage, and each is carried out only after its prerequisite work has been completed.
用語