問70
頻出度★★★
ISMS における情報セキュリティインシデントの管理に関する記述のうち, 適切なものはどれか。
令和8年度 ITパスポート試験 問70
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 70
Incorrectア
Incorrect. In an ISMS, the procedures for responding to incidents are required to be documented in advance so that the organization can respond consistently when the time comes. Recording the actual responses is of course necessary, but that is no reason to make advance preparation of the procedures unnecessary. Stating that they are not documented in advance is inappropriate.
Incorrectイ
Incorrect. Knowledge gained from incidents should be used to review and strengthen information security controls in order to prevent the recurrence of similar events. This is central to continual improvement through the PDCA cycle, so stating that it is not used to strengthen controls directly contradicts the ISMS way of thinking.
Incorrectウ
Incorrect. A reported information security event should first be assessed for its impact and the like, and only then judged whether or not it qualifies as an incident. Not every event becomes an incident; stating that it is classified as an incident at the point it is reported, without waiting for assessment, confuses the distinction between an event and an incident.
- エ
正解 The correct answer is エ. In incident management under an ISMS (JIS Q 27001 / 27002), you are required to decide and prepare in advance who to report to, through which channel, and by what mechanism, so that whoever discovers an information security event can act without hesitation. If the reporting channels and mechanisms are set up beforehand, an event can be promptly conveyed to the appropriate manager, leading to early assessment and response. This matches the ISMS principle of emphasizing advance preparation (readiness).
ここがポイント
- Incident management in an ISMS is fundamentally about advance preparation: set up reporting channels, mechanisms, and response procedures beforehand so that events can be reported and handled promptly.
- An information security event is classified as an incident only after assessment, and the knowledge gained is applied to preventing recurrence and strengthening controls (continual improvement).
用語