ITPEC IP October 2025 Question 44
Which of the following is the appropriate example of activities performed in C (Check) in the organizations that operate ISMS on the basis of the PDCA model?
Explanation
Objectively evaluating the server administrator's work by a third party — an evaluation of how the ISMS is actually working belongs to Check.
In the PDCA model of an ISMS:
- •Plan: identify the information assets, assess the risks, set the objectives and decide the measures
- •Do: put the measures in place and operate them according to the procedures
- •Check: monitor, measure and evaluate whether the measures work as intended, through internal audits, third-party reviews and management review
- •Act: take corrective actions and improve, based on what Check found
A third party evaluating the administrator's work objectively measures the ISMS in operation without changing it, so it is Check.
Answer (c)
Why not others:
- •(a) — changing the monitoring method as a corrective action, based on audit results, is Act
- •(b) — identifying the assets to decide the measures and objectives is Plan
- •(d) — watching the server according to the defined operational procedure is carrying out a measure day to day, which is Do
Key rule: Plan decides, Do carries out, Check evaluates the result against the plan, and Act corrects based on that evaluation; an action taken on audit results is Act, the audit itself is Check.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.