問77
頻出度★★★
PDCA モデルに基づいて ISMS を運用している組織の活動において, リスクマネジメントの活動状況の監視の結果などを受けて, 是正や改善措置を決定している。この作業は, PDCA モデルのどのプロセスで実施されるか。
令和3年度 ITパスポート試験 問77
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 77
Incorrectア
P (Plan) is the planning stage. In this stage the organization establishes the prerequisites for operation, such as the ISMS scope, basic policy, risk assessment procedures, and selection of controls; it does not decide corrective or improvement measures based on monitoring results.
Incorrectイ
D (Do) is the operation stage. In this stage the controls defined in Plan are actually introduced, implemented, and operated; it is not the work of deciding corrective or improvement measures.
Incorrectウ
C (Check) is the monitoring and review stage. Here the status of activities is monitored and reviewed (that is, the monitoring results themselves are obtained), but deciding corrective and improvement measures based on those results belongs to the next stage, Act. The point of this question is to distinguish monitoring from deciding on improvement, so the answer is not C.
- エ
正解 The PDCA cycle repeats four stages: Plan → Do → Check → Act. The work described in the question — deciding corrective actions and improvement measures based on the results of monitoring the status of risk management activities and similar inputs — corresponds to the stage of correcting and improving the ISMS based on problems found in the Check stage, namely Act (A). Therefore the correct answer is エ, 'A'.
ここがポイント
- The role of each stage of the PDCA cycle (Plan-Do-Check-Act): P = planning, D = operation, C = monitoring and review, A = improvement (correction). An ISMS achieves continual improvement through this cycle.
- Deciding corrective and improvement measures based on monitoring results is the work of Act (A). Grasp the flow of finding problems in C and deciding and carrying out corrections in A.
用語