令和5年度 ITパスポート試験 問56

※ Our check while writing this explanation could not fully confirm the published answer; scoring follows IPA's official key.

• ×Incorrectア

  ISMS Cloud Security certification covers any of the service models, namely IaaS, PaaS, and SaaS. The statement that excludes IaaS from its scope is incorrect.

• ○イ

  正解 ISMS Cloud Security certification uses ISO/IEC 27017 as its standard and is a system that an organization which has already obtained ISMS (ISO/IEC 27001) certification additionally acquires. A third party certifies that controls specific to cloud services (such as addressing cloud-specific risks and dividing operational responsibilities) have been appropriately established and implemented. Therefore, choice イ, which expresses the original intent that “it certifies that controls specific to cloud services have been appropriately introduced and implemented”, is appropriate, and the correct answer is イ.

• ×Incorrectウ

  The scope is not limited to organizations that provide cloud services; organizations that use cloud services can also be covered. The statement that uniformly excludes user organizations is incorrect.

• ×Incorrectエ

  Evaluating an organization's framework for protecting personal information and granting permission to use the Privacy Mark describes the Privacy Mark system (a personal-information protection scheme based on JIS Q 15001), which is a different system from ISMS Cloud Security certification.