IPA IP 2023 Question 56

A question IPA Japan published in 令和5年度 ITパスポート試験公開問題問56, translated into English. ITPEC is based on the same exams.

Which of the following is an appropriate description concerning ISMS cloud security certification?

a)PaaS and SaaS are covered, and IaaS is not covered.b)It certifies that controls specific to cloud services are appropriately introduced and implemented.c)Organizations that provide cloud services are covered, and organizations that use cloud services are not covered.d)It is a scheme that evaluates that a structure for taking appropriate protective measures for personal information stored in cloud services has been established and is being operated, and permits the use of the PrivacyMark.

Explanation

It certifies that controls specific to cloud services are introduced and implemented — that is the point of the ISMS cloud security certification.

ISMS cloud security certification is a Japanese scheme run by ISMS-AC. It is an add-on to ISO/IEC 27001 (ISMS) certification: an organization that already holds ISMS certification is additionally checked against ISO/IEC 27017, the code of practice for information security controls for cloud services. The certificate shows that the cloud-specific controls, such as the division of responsibilities between provider and customer and the separation of customers in a shared environment, are in place and working.

Answer (b)

Why not others:

•(a) — every service model is covered: IaaS as well as PaaS and SaaS
•(c) — ISO/IEC 27017 gives controls for both the cloud service provider and the cloud service customer, so organizations that use cloud services can be certified too
•(d) — this describes the PrivacyMark, a separate scheme for the protection of personal information (JIS Q 15001), not a cloud security certification

Key rule: ISMS cloud security certification = ISO/IEC 27001 certification plus the cloud-specific controls of ISO/IEC 27017, for providers and users alike.

Security · AI-written, may contain errors

Previous Next

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.