IPA IP 2022 Question 58
A question IPA Japan published in 令和4年度 ITパスポート試験 公開問題 問58, translated into English. ITPEC is based on the same exams.
In the planning, operation, performance evaluation, and improvement of an ISMS, which of the following is implemented in performance evaluation?
Explanation
Internal audit — performance evaluation is the check stage of an ISMS: monitoring and measurement, internal audit and management review.
ISO/IEC 27001 (JIS Q 27001 in Japan) runs an ISMS in a PDCA cycle, with these clauses for the four stages:
An internal audit checks whether the ISMS conforms to the organization's own requirements and the standard, and whether it is effectively implemented, so it belongs to performance evaluation.
Answer (b)
Why not others:
- •(a) — operational planning and control is done in operation (Do)
- •(c) — corrective action for nonconformities is done in improvement (Act), on the results of the evaluation
- •(d) — determining the risks is part of the risk assessment in planning (Plan)
Key rule: In an ISMS, Plan = risk assessment and treatment plan, Do = operation, Check = performance evaluation (monitoring, internal audit, management review), Act = corrective action and improvement.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.