令和3年度 ITパスポート試験問88

This question's explanation and your answers so far.

問88

頻出度★★★

ISMS のリスクアセスメントにおいて, 最初に行うものはどれか。

出典　令和3年度 ITパスポート試験問88

解説

問 88

Incorrectア
Risk treatment (the process of deciding measures such as risk reduction, avoidance, transfer, and acceptance) is carried out after receiving the results evaluated in risk assessment, so it comes at a stage after the assessment. It is not the first.
イ
正解 In ISMS (JIS Q 27000 / ISO 27001), risk assessment consists of three steps: “risk identification → risk analysis → risk evaluation.” Choice イ, risk identification, is the task of listing what risks (threats and vulnerabilities) exist for an organization’s information assets, and it is the first step of the assessment. Since you must first grasp the actual risks before you can analyze and evaluate them, the first thing performed is risk identification.
Incorrectウ
Risk evaluation is the process of comparing the magnitude of risk obtained through analysis with predetermined criteria (risk acceptance criteria) to judge whether treatment is needed and its priority. It is the third step, coming after identification and analysis, so it is not the first.
Incorrectエ
Risk analysis is the process of estimating the likelihood and impact of identified risks and calculating the magnitude (level) of the risk. It is the second step, carried out after risk identification, so it is not the first.

ここがポイント

The order of ISMS risk assessment: risk identification → risk analysis → risk evaluation (risk treatment comes afterward). The first is “risk identification.”
Distinguish that risk assessment refers to the three processes of identification, analysis, and evaluation, while risk treatment is not included in the assessment but is a separate process carried out after receiving the evaluation results.

用語

解答問88イ