問100
頻出度★★★
ISMS の活動に関する記述として，最も適切なものはどれか。
令和8年度 ITパスポート試験 問100
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 100
Incorrectア
Improving business processes to reduce a company’s costs and enhance product quality and services is an activity of BPM (Business Process Management) or BPR (Business Process Reengineering), not a description of ISMS, whose purpose is information security.
Incorrectイ
Continuously improving the quality of IT services to raise customer satisfaction is an activity of ITSM (IT Service Management, ITIL), a framework different from ISMS, whose main purpose is managing the risks of information assets.
- ウ
正解 ウ is correct. ISMS (Information Security Management System) is a framework for systematically managing an organization’s information security. The core of its activities is to first identify the “information assets” that must be protected, then perform risk “identification, analysis, and evaluation” for each one, and based on the evaluation results, appropriately manage the information assets (risk treatment). ウ describes exactly this sequence and is the most appropriate ISMS activity.
Incorrectエ
Assessing and improving the maturity of the development process for products and services is an activity of development-process improvement such as CMMI (Capability Maturity Model Integration), not an ISMS activity.
ここがポイント
- The core activity of ISMS is the flow “identify information assets → risk identification, analysis, and evaluation → risk treatment and management”, with the goal of protecting the confidentiality, integrity, and availability of information.
- Distinguish similar management frameworks (BPM/BPR, ITSM/ITIL, CMMI) by their purpose: ISMS = information security, ITSM = IT service quality, CMMI = development-process maturity.
用語