ITPEC FE Morning October 2022 Question 38
When security risk management processes incorporate the approach of the PDCA (Plan, Do, Check, Act) cycle, which of the following is a process that belongs to Act?
Explanation
Maintain and improve the plan by learning from incidents — Act takes what Check revealed and turns it into corrective action and improvement.
Security risk management mapped onto PDCA:
- •Plan: set the security policy and develop the risk management plan
- •Do: implement the plan
- •Check: monitor the risks and evaluate the results as planned
- •Act: correct and improve the plan based on those results and on incidents
Answer (c)
Why not others:
- •(a) — establishing the policy and developing the plan is Plan
- •(b) — carrying out the plan is Do
- •(d) — monitoring the risks as the plan prescribes is Check
Key rule: Act closes the loop: it feeds the findings of Check back into the next Plan. Look for "improve", "correct" or "learn from" to spot it.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.