令和4年度 ITパスポート試験問58

This question's explanation and your answers so far.

問58

頻出度★★★

ISMS の計画, 運用, パフォーマンス評価及び改善において, パフォーマンス評価で実施するものはどれか。

出典　令和4年度 ITパスポート試験問58

解説

問 58

Incorrectア
Planning and control of operation is an activity of the operation (Do) phase, in which the decided information security measures are actually put into practice; it is not part of performance evaluation.
イ
正解 The operation cycle of an ISMS (JIS Q 27001) corresponds to PDCA and consists of four phases: planning (Plan), operation (Do), performance evaluation (Check), and improvement (Act). In the performance evaluation (Check) phase, to confirm whether the ISMS functions as planned and is effective, monitoring, measurement, analysis, and evaluation are carried out, together with internal audit and management review. Therefore, what is performed in the performance evaluation phase is イ, internal audit, which is the correct answer.
Incorrectウ
Corrective action for nonconformities is an activity of the improvement (Act) phase, which fixes problems found during evaluation to make the ISMS better; it is not part of performance evaluation.
Incorrectエ
Determination of risks (identifying, analyzing, and evaluating risks through risk assessment) is a prerequisite for establishing measures and belongs to the planning (Plan) phase; it is not part of performance evaluation.

ここがポイント

The key point is that an ISMS corresponds to the PDCA cycle and that you can distinguish the activities of each phase: planning=Plan, operation=Do, performance evaluation=Check, improvement=Act.
The representative activities of the performance evaluation (Check) phase are monitoring, measurement, analysis, and evaluation, along with internal audit and management review.

用語

解答問58イ