IPA IP 2021 Question 79

A question IPA Japan published in 令和3年度 ITパスポート試験公開問題問79, translated into English. ITPEC is based on the same exams.

Which of the following is an appropriate description concerning “SECURITY ACTION,” a scheme that IPA established to accelerate the spread of information security measures in small and medium-sized enterprises?

a)A scheme in which the government subsidizes part of the costs required for obtaining ISMS certificationb)A scheme that is intended only for organizations that aim to make a profitc)A scheme in which an organization self-declares that it will work on information security measuresd)A scheme in which a third party certifies that an organization is working on information security measures

Explanation

A scheme of self-declaration — under SECURITY ACTION an SME declares by itself that it will work on information security measures.

SECURITY ACTION is a scheme of IPA, Japan's Information-technology Promotion Agency, for small and medium-sized enterprises. A company chooses a level and declares it on its own: the first level, “one star,” is a declaration that it will follow IPA's five basic security measures; the second, “two stars,” that it has checked its situation with IPA's self-assessment sheet and set and published a basic security policy. The company can then show the SECURITY ACTION logo. There is no audit and no certification by an outside body.

Answer (c)

Why not others:

•(a) — SECURITY ACTION is not a subsidy, and it is not about ISMS certification; it is a declaration the company makes on its own
•(b) — it is not limited to profit-making companies; non-profit organisations and other bodies can declare too
•(d) — certification by a third party describes schemes such as ISMS certification or the PrivacyMark; SECURITY ACTION involves no third-party review

Key rule: SECURITY ACTION is a self-declaration by an SME; certification by an outside body, as for ISMS, is a different kind of scheme.

Security · AI-written, may contain errors

Previous Next

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.