問93
頻出度★★★
次の ISMS における実施項目のうち, 最初に行うものはどれか。
令和8年度 ITパスポート試験 問93
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 93
- ア
正解 An ISMS (Information Security Management System) is operated through the PDCA cycle based on ISO/IEC 27001. First, unless you decide the scope of application of the ISMS — that is, which organizations, business operations, and information assets it covers — the subsequent risk assessment and risk treatment cannot be carried out, because their scope is undefined. Therefore, among the choices, the one performed first is “Determining the scope of application of the ISMS”, and the correct answer is “ア”. The general order of execution is: determining the scope → risk assessment → risk treatment → internal audit (the post-operation review).
Incorrectイ
Information security risk assessment is the task of identifying the threats, vulnerabilities, and risks to the assets within a scope, and it can only begin once the targets to be protected (the scope of application) have been decided. Since it comes after determining the scope, it is not the first step.
Incorrectウ
Information security risk treatment is the step of selecting measures such as reduction, avoidance, transfer, or acceptance for the risks evaluated in the risk assessment. Because it depends on the results of the assessment, it comes even later than determining the scope or performing the assessment.
Incorrectエ
Internal audit corresponds to the Check stage of PDCA, and it is the step of confirming the effectiveness of the ISMS after it has been built and put into operation. Among the implementation items it is close to the final stage, and it is not what is performed first.
ここがポイント
- An ISMS is operated through the PDCA cycle, and the starting point of building it is “determining the scope of application (the organizations and assets it covers)”.
- Standard order of execution: determining the scope → risk assessment → risk treatment → internal audit (the post-operation review).
用語