問86
頻出度★★★
PDCA モデルに基づいて ISMS を運用している組織において, C (Check) で実施することの例として, 適切なものはどれか。
令和6年度 ITパスポート試験 問86
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 86
Incorrectア
Changing the monitoring method as a corrective action based on audit results is an activity of making improvements and corrections in response to inspection results, which falls under A (Act). Because it is the stage of taking measures based on the findings obtained in Check, it is not Check itself.
Incorrectイ
Identifying and listing information assets in order to decide specific countermeasures and goals is an activity of grasping assets and setting countermeasures and objectives for the purpose of planning, which falls under P (Plan). It is a preparatory stage before operation, not Check.
- ウ
正解 The C (Check) phase of the PDCA cycle is the stage where you monitor and measure, then inspect and evaluate, whether the ISMS is being operated in line with the policy and objectives set in the Plan phase. Choice ウ, having a third party objectively evaluate the work content of the server administrator, is the act of objectively inspecting and auditing the actual state of operations through eyes other than those of the parties involved, which is exactly a typical example of Check. Therefore ウ is appropriate.
Incorrectエ
Monitoring the operation of the server according to the established operating procedures is an activity of actually operating and implementing the ISMS in line with the planned procedures, which falls under D (Do). It is monitoring as part of routine operation, and is at a different stage from Check, which inspects and evaluates the results of operation.
ここがポイント
- Roles of each phase of the PDCA cycle: P = planning of policy, objectives, and countermeasures / listing of assets; D = operation and implementation following procedures; C = inspection and evaluation through monitoring, measurement, and auditing; A = corrective action and improvement.
- A typical example of C (Check) is objective inspection by parties other than those involved, such as internal auditing and third-party evaluation; it should be distinguished from correction (Act) and from routine-operation monitoring (Do).
用語