ITPEC IP April 2019 Question 42

Effectiveness of the processes is measured and evaluated — C in PDCA is Check, the step that monitors and reviews what Do put in place.

In information security management (ISMS) the PDCA cycle runs:

• •Plan — establish the security objectives, processes and procedures
• •Do — introduce and operate them
• •Check — measure and evaluate their effectiveness against the objectives (monitoring, review, internal audit)
• •Act — improve through corrective and preventive actions, based on that evaluation

Answer (d)

Why not others:

• •(a) — establishing the objectives, processes and procedures is Plan
• •(b) — improvement through corrective and preventive actions is Act, which follows the Check evaluation
• •(c) — introducing and operating the processes and procedures is Do

Key rule: Check evaluates, Act improves: an option that acts "on the basis of an evaluation" is the step after Check, not Check itself.

Security · AI-written, may contain errors