Information Security Basics
When an ISMS (information security management system) is run using the PDCA cycle, which activity belongs to the Check stage?
- AConfirming, through monitoring and internal audits, that the planned measures are actually followed and are effective
- BAnalyzing risks and deciding the information security policy and the plan of measures
- CTaking corrective actions to remove the causes of problems found and improving the system
Show answer and explanation
Answer: A. Confirming, through monitoring and internal audits, that the planned measures are actually followed and are effective
An ISMS is a framework that lets an organization manage and improve information security continuously rather than treating it as a one-time measure; its requirements are defined in ISO/IEC 27001 (JIS Q 27001 in Japan). It is run with the PDCA cycle of Plan, Do, Check and Act. In Plan, risks are analyzed and evaluated and the policy and measures are decided. In Do, the measures are introduced and operated, and staff are trained. In Check, monitoring and measurement, internal audits and management reviews confirm whether the measures are followed and effective. In Act, corrective actions are taken on problems found and reflected in the next plan.
- A. Correct. Confirming through monitoring and internal audits that measures are followed and effective is the Check stage.
- B. Analyzing risks and deciding the policy and plan belongs to the Plan stage.
- C. Taking corrective actions to improve the system belongs to the Act stage.