This question's explanation and your answers so far.
PDCA モデルに基づいて ISMS を運用している組織の活動において, 次のような調査報告があった。この調査は PDCA モデルのどのプロセスで実施されるか。 社外からの電子メールの受信に対しては, 情報セキュリティポリシーに従ってマルウェア検知システムを導入し, 維持運用されており, 日々数十件のマルウェア付き電子メールの受信を検知し, 破棄するという効果を上げている。しかし, 社外への電子メールの送信に関するセキュリティ対策のための規定や明確な運用手順がなく, 社外秘の資料を添付した電子メールの社外への誤送信などが発生するリスクがある。
P (Plan) is the planning stage of setting the ISMS's policy and objectives, assessing risks, and formulating controls and operating procedures. The investigation report is not an activity of making a new plan but of inspecting measures already in operation, so it is not Plan.
D (Do) is the implementation stage of actually introducing and operating the planned controls (the introduction and maintenance of the malware detection system itself corresponds to Do). The investigation report is an activity of “monitoring and evaluating” the results of that operation, not the operational work itself, so it is not Do.
正解 The correct answer is ウ (C = Check). In PDCA, Check is the stage of monitoring, inspecting, and evaluating whether the ISMS in operation is functioning according to the information security policy and procedures and producing results, while identifying deficiencies and weaknesses. This investigation report, on one hand, confirms the effectiveness by noting that “malware detection for received e-mail has been introduced and maintained and produces results every day”, while on the other hand pointing out the deficiency that “there are no rules or clear operating procedures for sent e-mail, posing a risk of misdelivery”. This is precisely the activity of inspecting and evaluating the current operational status to find problems, which corresponds to the Check process.
A (Act) is the stage of taking corrective and improvement actions based on the inspection results; here, responses such as newly establishing rules and operating procedures for sending e-mail correspond to it. The investigation report only reaches the stage of “identifying” problems and has not yet carried out improvement actions, so it is not Act.