問72
頻出度★★★
情報セキュリティのリスクマネジメントにおけるリスク対応を, リスク回避, リスク共有, リスク低減及びリスク保有の四つに分類したとき, リスク共有の説明として, 適切なものはどれか。
令和5年度 ITパスポート試験 問72
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 72
Incorrectア
A response that stops the risk-bearing activity itself or fundamentally eliminates the risk factors is a description of “risk avoidance”, not risk sharing.
Incorrectイ
Measures that reduce the probability of a risk occurring or the damage itself, such as geographically distributing data centers, are a description of “risk reduction”, not risk sharing.
- ウ
正解 The correct answer is “ウ”. Risk sharing (also called risk transfer or risk diversification) is a response in which an organization does not bear a risk entirely on its own, but instead transfers it to, or shares it with, another organization under a certain agreement (contract), thereby reducing the damage when the risk materializes. A typical example is taking out insurance, which transfers the loss to an insurance company. Sharing responsibility through outsourcing or contracting out work follows the same idea, and “ウ”, which explicitly states “transferring or distributing to another organization”, best matches the description of risk sharing.
Incorrectエ
A response that judges the probability or damage to be small and, after recognizing the risk, deliberately accepts it without taking any special countermeasures, is a description of “risk retention (risk acceptance)”, not risk sharing.
ここがポイント
- The four categories of risk treatment: risk avoidance (stopping activities, eliminating factors) / risk reduction (reducing the probability or damage) / risk sharing (transferring or distributing to other organizations via insurance or outsourcing) / risk retention (accepting a small risk after recognizing it).
- Risk sharing is also called “risk transfer” or “risk diversification”, with taking out insurance being a typical example. The key that distinguishes it from the other three is having someone else bear or share the loss.
用語