Match the major standard series to the fields they cover, such as quality, the environment, and information security.
Tell apart requirements standards, which serve as the basis for certification, from guidance and guidelines standards, which are not meant for certification.
Distinguish the JIS Q standards for risk management and IT governance by what they cover and who carries them out.
ISO 9000 is a family of international standards on the quality management system (QMS), the framework an organization uses to deliver products and services of consistent quality.
ISO 9000 itself sets out the basic concepts and vocabulary, while the requirements (要求事項) an organization must meet are collected in ISO 9001. When a third-party certification body audits an organization and finds that it conforms to ISO 9001, the organization can be certified. The system is run by turning the PDCA cycle of plan, do, check, and act to improve it step by step.
AnalogyIt resembles a restaurant chain's shared operations manual that makes every branch serve the same taste and service no matter who is cooking, paired with outside inspectors who check how well the manual is followed.
Exam points
ExamThe standard that sets out the requirements (要求事項) for a quality management system (品質マネジメントシステム) is ISO 9001, and Japan uses JIS Q 9001, its Japanese-language version.
ExamIn the ISO 9000 view, quality is judged by how far the inherent characteristics of a product meet the required conditions. Customer satisfaction therefore serves as a measure of quality.
ExamAdopting ISO 9001 aligns how quality-related work is done across the organization, which helps improve the quality and efficiency of management.
ISO 14000 is a family of international standards on the environmental management system (EMS), the framework for managing and steadily reducing the environmental impact of business activities.
Its core requirements are in ISO 14001, and conformity with it qualifies an organization for third-party certification. The organization identifies its environmental impacts, such as waste, energy use, and emissions, sets targets, and keeps improving through PDCA.
AnalogyIt is like a household that logs its electricity bill and trash each month and keeps finding ways to cut them toward a goal, turned into a fixed procedure for the whole company.
Exam points
ExamThe family of ISO standards for environmental management systems (環境マネジメントシステム) is ISO 14000, and its requirements, which serve as the basis for certification, are in ISO 14001.
ISO 26000 is international guidance that sets out how any organization, not only companies, can meet its social responsibility (SR).
It covers a wide range of the ways an organization affects society, including human rights, labor practices, the environment, consumer issues, and community involvement. Organizations use it as a reference and pick the issues that fit their own activities.
AnalogyRather than a certification exam with a passing score, it is closer to a handbook on how to behave as a good citizen.
Exam points
Mix-upISO 9001 and ISO 14001 are requirements standards that serve as the basis for certification, whereas ISO 26000 is guidance (手引) not intended for certification.
ISO/IEC 27000 is a family of international standards, developed jointly by ISO and IEC, on the information security management system (ISMS), the framework for protecting information.
Standard
Role
ISO/IEC 27001
ISMS requirements; basis for certification
ISO/IEC 27002
Guidance on controls
ISO/IEC 27017
Guidelines on controls for cloud services
This family defines information security as preserving the confidentiality, integrity, and availability of information. The specific measures taken to reduce risk are called controls (管理策), and the series includes standards with different roles, such as requirements, guidance on controls, and supplements for specific fields.
AnalogyInstead of buying locks, a safe, and security cameras piecemeal, it is like drawing up a family security plan that decides what to protect and includes the habit of reviewing the measures.
How to rememberThe first letters of each abbreviation name the field: Q in QMS for quality, E in EMS for environment, and IS in ISMS for information security.
Exam points
ExamThe Japanese national standard that sets out requirements for information security management (情報セキュリティマネジメント) is JIS Q 27001, which is based on ISO/IEC 27001.
ExamISO/IEC 27017 is a set of guidelines that builds on the 27000-series guidance on controls (管理策) and adds controls for cloud service (クラウドサービス) providers and customers.
ISO 30414 is an international standard for measuring the state of an organization's human capital, its people, and reporting it internally and externally; the 2018 edition is written as guidelines.
It sets out an approach to metrics that show in numbers the return on investment in people and the state of the workforce. The results can inform internal management decisions as well as explanations to investors and other outside parties.
AnalogyIt is like taking only the people-related items from a company's health checkup form, leaving out equipment and money, and giving them a common format.
Exam points
Mix-upISO 30414 covers reporting on information about people, whereas ISO 26000 is guidance on an organization's social responsibility as a whole.
JIS Q 31000 is the Japanese national standard that sets out the principles and process of risk management.
Risk identification
Risk analysis
Risk evaluation
Risk treatment
Choose a way to deal with the risk and carry it out.
4 / 4
It is the Japanese version of the international standard ISO 31000 and is written as guidelines that any organization can use regardless of industry or size. JIS Q 31000:2019 defines risk as "the effect of uncertainty on objectives" and lays out a flow in which a risk assessment (リスクアセスメント), covering the identification, analysis, and evaluation of risks against criteria, comes first and its results shape the risk treatment.
AnalogyIt is like listing your worries before a trip, such as bad weather or forgetting something, ranking them by how likely and how troublesome they are, and arranging insurance and a backup plan.
How to rememberThe Q in JIS Q is a JIS division letter that stands for the management system field.
JIS Q 38500 is the Japanese national standard that sets out the principles and guidelines of IT governance, in which an organization's top management takes responsibility for directing its use of IT.
Evaluate
Direct
Monitor
Monitor: watch whether results are coming as planned and feed them into the next evaluation.
3 / 3
It is the Japanese version of the international standard ISO/IEC 38500, and JIS Q 38500:2015 presents a model in which top management, as the governing body, evaluates, directs, and monitors IT. It is a framework for checking whether IT investment and use align with business objectives.
AnalogyOn a ship, the officers handle day-to-day steering while the captain sets the destination and checks progress; this standard defines the captain's part.
How to rememberFor the 2015 model, take the initials of Evaluate, Direct, and Monitor and remember them as EDM.
Exam points
Mix-upUnder JIS Q 38500, the party that evaluates (評価), directs (指示), and monitors (モニタ) the use of IT is the organization's top management (経営者層), not the front-line staff who run IT.
JIS Q 31000 vs. JIS Q 38500
Aspect
JIS Q 31000
JIS Q 38500
Key differenceSubject
Risks that affect an organization's objectives
An organization's use of IT
Main actors
Every level of the organization
Top management as the governing body
Main content
The flow of risk assessment and risk treatment
The evaluate-direct-monitor model (2015 edition)
Source international standard
ISO 31000
ISO/IEC 38500
Key points
The 9000 series covers quality, the 14000 series the environment, and the 27000 series information security management systems, and the 27000 series is developed jointly by ISO and IEC.
In the quality, environment, and information security series, each series' requirements standard is the basis for third-party certification.
JIS Q 31000 and JIS Q 38500 are Japanese national standards that adapt the international standards ISO 31000 and ISO/IEC 38500, respectively, into Japanese.