IPA IP 2025 Question 2
A question IPA Japan published in 令和7年度 ITパスポート試験 公開問題 問2, translated into English. ITPEC is based on the same exams.
Which of the following is the most appropriate guideline standard that was additionally established on the basis of the existing information security management system standards, for building an information security management structure suited to cloud services?
Explanation
ISO/IEC 27017 — the code of practice that adds cloud-specific information security controls to the ISMS standards.
The ISMS family starts from ISO/IEC 27001 (requirements for an information security management system) and ISO/IEC 27002 (the guidelines for its controls). ISO/IEC 27017 was built on 27002: it adds guidance and extra controls for cloud services, such as how responsibilities are split between the cloud service provider and the cloud service customer, the separation of customers' environments in a virtual setting, and the monitoring of cloud services. A provider or a customer uses it to extend its ISMS to the cloud.
Answer (c)
Why not others:
- •(a) ISO 14001 — the international standard for environmental management systems
- •(b) JIS Q 15001 — Japan's standard for personal information protection management systems, the basis of the PrivacyMark scheme
- •(d) ISO 9001 — the international standard for quality management systems
Key rule: ISO/IEC 27001 and 27002 define the ISMS and its controls; 27017 extends them to cloud services (and 27018 to personal data in public clouds); 9001 is quality, 14001 environment.
Legal Affairs · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.