IPA IP 2026 Question 70
A question IPA Japan published in 令和8年度 ITパスポート試験 公開問題 問70, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate description concerning the management of information security incidents in ISMS?
Explanation
Reporting channels and a mechanism prepared in advance — information security events must reach the appropriate manager quickly.
In ISMS (ISO/IEC 27001 and its controls), incident management runs in a fixed order: an information security event is reported, it is assessed to decide whether it is an incident, the incident is responded to, and the lessons are fed back into the controls. The first step only works if everyone already knows whom to report to and how, so the reporting channels and mechanism are set up beforehand.
Answer (d)
Why not others:
- •(a) — response procedures are documented in advance so incidents are handled consistently; recording only what was actually done leaves no prepared procedure
- •(b) — knowledge gained from incidents is meant to be used to strengthen the controls and reduce the chance of recurrence
- •(c) — an event is assessed first; only those judged to be incidents are classified as information security incidents
Key rule: ISMS incident management: report events through a prepared channel, assess them, respond with documented procedures, and learn from them.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.