IPA IP 2024 Question 82
A question IPA Japan published in 令和6年度 ITパスポート試験 公開問題 問82, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate description concerning the ISMS cloud security certification?
Explanation
Certifies that cloud-specific controls are implemented for a cloud service — ISMS cloud security certification adds cloud controls to an ISMS certification.
The scheme, run in Japan under ISMS-AC, certifies a cloud service of an organisation that already holds ISMS (ISO/IEC 27001) certification. On top of the ISMS it checks the controls specific to cloud services set out in ISO/IEC 27017, such as the division of security responsibilities between provider and customer and the separation of customers' environments.
Answer (b)
Why not others:
- •(a) — one authentication giving access to many services and systems is single sign-on
- •(c) — evaluating a business's personal information protection and granting it the PrivacyMark is the PrivacyMark system, which is about personal information, not cloud controls
- •(d) — judging the risk of a login from its environment and IP address and asking for more authentication when it is high is risk-based authentication
Key rule: ISMS certification covers an organisation's information security management; ISMS cloud security certification adds the cloud-specific controls of ISO/IEC 27017 for a particular cloud service.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.