問38
頻出度★★★
情報セキュリティ監査の説明として, 最も適切なものはどれか。
令和7年度 ITパスポート試験 問38
マネジメント系システム監査 › システム監査
This question's explanation and your answers so far.
解説
問 38
Incorrectア
“Verifying and evaluating the use of IT systems based on certain criteria, and providing assurance regarding the appropriateness of governance and advice for improvement” describes a broad systems audit (IT audit) that is not limited to the risk management of information assets. As a description pointing specifically to an information security audit, its scope is too wide.
Incorrectイ
“A tool that physically prevents the theft or unauthorized removal of computers in order to ensure information security” refers to a physical security countermeasure device such as a security wire, not an audit (a verification or evaluation activity).
Incorrectウ
“Formulating an IT strategy and policy that shows how IT systems should ideally be used in an organization, and carrying out activities to realize them, in order to enhance the value of and trust in the organization” is a description of IT governance. This is not an audit but an initiative by management to control and direct IT, which is a separate concept.
- エ
正解 The correct answer is エ. An information security audit is an activity that verifies or evaluates, from an independent standpoint, whether the risk management (identification, assessment, and treatment of risks) relating to an organization's information assets is being implemented effectively. The statement in エ, “Verifying or evaluating whether risk management relating to an organization's information assets is being carried out effectively,” is exactly this definition itself, and is the most appropriate description of an audit focused on information security.
ここがポイント
- Information security audit = verifying and evaluating, from an independent standpoint, whether the risk management relating to an organization's information assets is functioning effectively.
- Do not confuse it with a systems audit (verifying IT governance overall), IT governance (formulating and realizing a strategy that shows how IT should be), or a physical security tool.
用語