問79
頻出度★★★
中小企業の情報セキュリティ対策普及の加速化に向けて, IPA が創設した制度である “SECURITY ACTION” に関する記述のうち, 適切なものはどれか。
令和3年度 ITパスポート試験 問79
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 79
Incorrectア
SECURITY ACTION is a system for self-declaration, not a subsidy system in which the government subsidizes part of the cost of obtaining ISMS certification. Describing it as a system whose main purpose is cost subsidy is incorrect.
Incorrectイ
The scope is not limited to profit-making organizations. Besides small and medium-sized enterprises, NPOs, various groups, and sole proprietors can also take part, so describing it as targeting only profit-making organizations is incorrect.
- ウ
正解 SECURITY ACTION is a system established by IPA to accelerate the spread of information security measures among small and medium-sized enterprises; it is a mechanism in which a company self-declares that it will work on information security measures. Depending on its level of effort, the company can use a one-star or two-star logo mark, and it does not need to obtain certification from an external review body. Because the description of a system in which an organization self-declares is the very definition of the system, choice ウ is appropriate.
Incorrectエ
Certification by a third party (third-party certification) applies to mechanisms such as ISMS certification, whereas SECURITY ACTION is a self-declaration system in which the company itself declares. Describing it as third-party certification conflicts with the nature of the system, so it is incorrect.
ここがポイント
- SECURITY ACTION is a self-declaration system established by IPA for small and medium-sized enterprises, using one-star and two-star logos to express the effort (it is not third-party certification).
- The key point of this question is being able to distinguish it from ISMS certification, which undergoes review and certification by a third party (self-declaration vs third-party certification).
用語