IPA IP 2026 Question 93
A question IPA Japan published in 令和8年度 ITパスポート試験 公開問題 問93, translated into English. ITPEC is based on the same exams.
Among the following items implemented in an ISMS, which of the following is performed first?
Explanation
Determining the scope of the ISMS — the scope must be fixed before the risks within it can be assessed, treated or audited.
An ISMS (ISO/IEC 27001) is set up in this order:
- Determine the scope: which organization, sites, information assets and processes the ISMS covers.
- Establish the information security policy for that scope.
- Information security risk assessment: identify, analyze and evaluate the risks to the information assets in the scope.
- Information security risk treatment: choose controls to reduce, avoid, transfer or accept each risk.
- Operate the controls, check them with internal audits and management review, and improve.
Answer (a)
Why not others:
- •(b) — risk assessment looks at the information assets inside the scope, so the scope has to exist first
- •(c) — risk treatment acts on the results of the risk assessment, so it comes after (b)
- •(d) — an internal audit checks an ISMS that is already running (the Check of the PDCA cycle), so it comes last of the four
Key rule: ISMS order: scope, policy, risk assessment, risk treatment, operation, internal audit, improvement; nothing can be assessed before it is clear what the ISMS covers.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.