IPA IP 2021 Question 77
A question IPA Japan published in 令和3年度 ITパスポート試験 公開問題 問77, translated into English. ITPEC is based on the same exams.
Same question on ITPEC: Apr 2025 Q43
In the activities of an organization that runs an ISMS on the basis of the PDCA cycle, improvements and corrective measures are decided from the results of monitoring of the risk management activities and other such information. In which process of the PDCA cycle is this activity performed?
Explanation
A (Act) — deciding improvements and corrective measures from the monitoring results is the last step of the PDCA cycle.
In an ISMS the four steps are:
- •Plan — set the security policy and objectives, assess the risks and plan their treatment and the controls
- •Do — implement and operate the controls as planned
- •Check — monitor and measure the controls, run internal audits and management reviews, and compare results with the objectives
- •Act — take corrective and improvement actions based on what Check found
The activity starts from monitoring results, the output of Check, and decides what to change, so it is Act. The changes then feed the next Plan.
Answer (d)
Why not others:
- •(a) P — Plan sets policy, assesses risks and designs controls; it comes before anything has been monitored
- •(b) D — Do puts the planned controls into operation; it does not evaluate or improve them
- •(c) C — Check produces the monitoring results this activity uses; deciding the improvements comes after it
Key rule: Check finds the gaps and Act decides and makes the fixes; the cycle then repeats, so an ISMS improves continually rather than being set up once.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.