ITPEC IP April 2022 Question 40
Which of the following is an appropriate example of activities conducted in A (Act) in the organizations that operate ISMS on the basis of the PDCA model?
Explanation
Changing the server monitoring method as a corrective action for the audit results — Act means acting on what Check found.
In an ISMS run on the PDCA model:
- •Plan: define the scope, identify information assets, assess risks and choose controls
- •Do: implement and operate the controls, following the defined procedures
- •Check: monitor and review, audit, evaluate the results objectively
- •Act: take corrective action on the findings and improve the ISMS
Changing the monitoring method because the audit found a problem is the corrective action of Act.
Answer (a)
Why not others:
- •(b) — objective evaluation by a third party is an audit, part of Check
- •(c) — identifying information assets is the first step of risk assessment, part of Plan
- •(d) — running the server monitoring as the procedure defines is operating a control, part of Do; judging whether it works would be Check
Key rule: Check finds the problem and Act fixes it; an activity is Act only when it changes the system in response to an evaluation.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.