ITPEC IP April 2025 Question 43
In the activities of an organization that runs an ISMS on the basis of the PDCA cycle, improvements and corrective measures are decided from the results of monitoring of the risk management activities and other such information. In which process of the PDCA cycle is this activity performed?
Explanation
A (Act) — deciding improvements and corrective measures from the monitoring results is the last step of the PDCA cycle.
In an ISMS the four steps are:
- •Plan — set the security policy and objectives, assess the risks and plan their treatment and the controls
- •Do — implement and operate the controls as planned
- •Check — monitor and measure the controls, run internal audits and management reviews, and compare results with the objectives
- •Act — take corrective and improvement actions based on what Check found
The activity starts from monitoring results, the output of Check, and decides what to change, so it is Act. The changes then feed the next Plan.
Answer (d)
Why not others:
- •(a) P — Plan sets policy, assesses risks and designs controls; it comes before anything has been monitored
- •(b) D — Do puts the planned controls into operation; it does not evaluate or improve them
- •(c) C — Check produces the monitoring results this activity uses; deciding the improvements comes after it
Key rule: Check finds the gaps and Act decides and makes the fixes; the cycle then repeats, so an ISMS improves continually rather than being set up once.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.