令和7年度 ITパスポート試験問2

This question's explanation and your answers so far.

問2

頻出度★★☆

従来の情報セキュリティマネジメントシステム規格を基礎に追加で制定されたもので, クラウドサービスに対応した情報セキュリティ管理体制を構築するためのガイドライン規格として, 最も適切なものはどれか。

出典　令和7年度 ITパスポート試験問2

解説

問 2

Incorrectア
ISO 14001 is a standard for environmental management systems (EMS) and is unrelated to information security. It is neither based on the ISMS nor adapted to cloud services.
Incorrectイ
JIS Q 15001 is a standard for personal information protection management systems (PMS) (the criteria for the Privacy Mark). It specializes in the handling of personal information and is not an ISMS-based guideline for cloud services.
ウ
正解 The correct answer is ウ, ISO/IEC 27017. Based on the ISO/IEC 27000 family of ISMS standards (in particular ISO/IEC 27002, which defines security controls), it is a guideline standard that compiles information security controls for addressing risks specific to cloud services. Targeting both cloud service providers and customers, it additionally specifies cloud-specific topics such as separation of virtual environments and division of management responsibilities, fully satisfying the conditions in the question, namely “established as an addition based on the conventional ISMS standard” and “adapted to cloud services.”
Incorrectエ
ISO 9001 is a standard for quality management systems (QMS), aimed at ensuring the quality of products and services. It is not a standard concerning information security or cloud services.

ここがポイント

ISO/IEC 27017 is a guideline standard for cloud-oriented information security controls, based on the ISMS (the ISO/IEC 27000 family).
Distinguish the targets of management system standards: 27000 = information security, 14001 = environment, 9001 = quality, JIS Q 15001 = personal information protection (PMS).

用語

解答問2ウ