IPA IP 2026 Question 79
A question IPA Japan published in 令和8年度 ITパスポート試験 公開問題 問79, translated into English. ITPEC is based on the same exams.
In promoting cybersecurity risk countermeasures that are carried out as part of the risk management of a company, which of the following is the most appropriate role required of the management?
Explanation
Management leads the measures itself — cybersecurity is a business risk, so top management sets the policy, provides budget and people, and checks how the measures are carried out.
A cyberattack can halt the business, leak customer data and damage trust, so cybersecurity is handled as part of the company’s risk management. Japan’s Cybersecurity Management Guidelines (METI and IPA) make this their first principle: management must recognise cybersecurity risk and drive the countermeasures with its own leadership. In practice that means deciding the implementation policy, allocating budget and human resources, checking the implementation status, and identifying problems and having them dealt with.
Answer (c)
Why not others:
- •(a) — a security person in the IT department has neither the authority nor the company-wide view to set the policy for every department, and management would take no part
- •(b) — appointing a CISO is good practice, but leaving all execution and judgment to the CISO means management gives up its own role of directing and checking
- •(d) — an outside consultant can advise, but the authority and responsibility for the company’s own risks cannot be handed to someone outside the company
Key rule: Management can assign cybersecurity work to a CISO, the IT department or consultants, but it must set the direction, fund the measures and monitor them itself.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.