IPA IP 2021 Question 88
A question IPA Japan published in 令和3年度 ITパスポート試験 公開問題 問88, translated into English. ITPEC is based on the same exams.
Same question on ITPEC: Oct 2022 Q45
In ISMS risk assessment, which of the following is performed first?
Explanation
Risk identification — risk assessment starts by finding and listing the risks; analysis and evaluation need that list.
In an ISMS (ISO/IEC 27001, following ISO 31000), risk assessment is three steps in order:
- Risk identification — find the risks: the information assets, their threats and vulnerabilities, and the owner of each risk
- Risk analysis — determine each risk's level from its likelihood and its consequences
- Risk evaluation — compare the levels with the risk acceptance criteria and set the priorities for treatment
Risk treatment comes after the assessment and is not part of it.
Answer (b)
Why not others:
- •(a) Risk treatment — choosing and applying a response (reduce, avoid, transfer, accept) follows the assessment; it is not its first step
- •(c) Risk evaluation — the last step of the assessment; it compares risk levels that the analysis has already produced
- •(d) Risk analysis — the second step; only risks that have been identified can be analysed
Key rule: Risk assessment runs identification, analysis, evaluation; treatment follows it, and the cycle is repeated as assets and threats change.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.