IPA IP 2023 Question 79
A question IPA Japan published in 令和5年度 ITパスポート試験 公開問題 問79, translated into English. ITPEC is based on the same exams.
In the activities of an organization that operates an ISMS on the basis of the PDCA model, the following investigation report was made. In which process of the PDCA model is this investigation performed?
Concerning the receipt of e-mail from outside the company, a malware detection system has been introduced in accordance with the information security policy and is maintained and operated, and it achieves the effect of detecting and discarding dozens of received e-mails with malware attached every day. However, there are no rules or clear operating procedures for security measures concerning the sending of e-mail outside the company, and there is a risk that an incident such as the mistaken sending of an e-mail with company-confidential material attached to an address outside the company may occur.
Explanation
C (Check) — the report evaluates how the ISMS is working and points out a gap, which is monitoring and review.
The four processes of an ISMS run on the PDCA model:
- •P (Plan) — set the security policy, assess the risks and plan the controls
- •D (Do) — introduce and operate the planned controls
- •C (Check) — monitor and measure how the controls work, review their effectiveness, audit
- •A (Act) — take corrective action and improve on the basis of what Check found
The report measures the result of a control that is already running (the malware detection system catches dozens of infected e-mails a day) and finds that outgoing e-mail has no rules or procedures, leaving the risk of mis-sent confidential material. Measuring effectiveness and finding shortfalls is Check; writing the missing rules would come next, as Act.
Answer (c)
Why not others:
- •(a) P — Plan decides policy and controls before they run; this report looks back at a control already in operation
- •(b) D — introducing and operating the malware detection system was Do; the report is about its results, not the operation itself
- •(d) A — Act would decide and carry out the fix, such as rules for outgoing e-mail; the report only identifies the risk
Key rule: In PDCA, measuring, evaluating and auditing what is in place is Check; deciding on improvements from those findings is Act.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.