Contractors, Education, and Auditing

Company A, a mail-order retailer, outsources customer-list data entry to Company B. The contract stipulates a confidentiality obligation and safety-management measures, and Company B has also obtained ISMS certification. One day, an employee of Company B copied working data to a personal PC and took it home, from which the names and addresses of about 5,000 customers leaked. Company B has apologized and reported the details, and says the employee involved has been disciplined. You, a leader in Company A's sales department, are to explain the response policy at an internal meeting. At the meeting, an opinion has been raised that "since Company B was contractually obligated, our company need not come forward." Which of the following is the most appropriate view of Company A's responsibility here?

1. Outsourcing the handling of personal data does not eliminate the outsourcer's responsibility, and Company A should take the lead in deciding on notification to affected individuals and public announcement
2. Since Company B was the one actually handling the information, reporting to the supervisory authority and explaining recurrence-prevention measures are both Company B's sole responsibility
3. Company A's responsibility is discharged by claiming damages from Company B
4. Since the outsourcing contract obligated Company B to implement safety management, it can be said that Company A itself need not contact the affected individuals or make a public announcement

Company A's general affairs department is selecting a new contractor for payroll processing. Since employee names, bank account numbers, and salary amounts will be handed over, it decided to add information security as a selection criterion alongside price. There are three candidate companies, and responses have been received from each on a checklist. The head of general affairs says, "above all, I want to keep costs down," but you, the leader, have organized the responses to serve as a basis for judgment. The response results are as shown in the following table. From an information security standpoint, which of the following is the most appropriate judgment?

確認項目                          X社  Y社                     Z社------------------------------------------------------------------情報セキュリティ責任者の設置      有   有                      有従業者への年次教育                済   済                      未再委託の予定                      無   有（事前承認手続あり）  有（詳細は不明）監査（立入りまたは書面）の受入れ  可   可                      不可事故発生時の報告期限の明記        可   可                      不可提示価格                          高   中                      低

1. Since Company Y plans to subcontract further, exclude it unconditionally from consideration on that point alone, regardless of its evaluation on other items
2. Since Company X's quoted price is the highest among the candidates, exclude it from consideration even if it satisfies all other items
3. Since Company Z has the lowest price and also has a responsible officer in place, select it on the premise that employee training and audit acceptance will be improved after the contract is signed
4. Since Company Y has a prior-approval procedure for subcontracting and accepts audits, make it a candidate after confirming how it manages its subcontractors

Company A has outsourced maintenance of its core system to Company B. The contract states, "When subcontracting is to be performed, prior written approval from the outsourcer must be obtained." One afternoon, a representative of Company B called you, Company A's information security leader, saying, "We are short-staffed due to a busy period and want to have our partner Company C help with part of the work starting tomorrow. It's urgent, so could we get your verbal okay?" Company C's work requires connecting to the maintenance environment, which contains Company A's customer data. Company B explains, "We have a long relationship with Company C and there is no problem." What should you do first?

1. Have Company A contract directly with Company C, bypassing Company B, to structure it so that it does not count as subcontracting
2. Since the proposal of subcontracting itself constitutes a breach of contract, immediately terminate the outsourcing contract with Company B
3. Have them submit in writing the name and location of subcontractor Company C, the scope and duration of the work, the type of information handled, and whether Company C is under an equivalent confidentiality and safety-management obligation by contract
4. Since it is urgent, give verbal approval on the spot by phone, and receive the written document listing the subcontractor's name and work scope together after the work has begun

Company A is newly outsourcing its inquiry help-desk operations to Company D, and you, the leader, reviewed the contract draft forwarded from the legal department. The draft defines a confidentiality obligation, a prohibition on use for purposes other than intended, prior approval for subcontracting, and an obligation to report in the event of an incident. On the other hand, there is no provision for returning or deleting entrusted data at contract termination, nor any provision for accepting an audit by which Company A can confirm the state of implementation. The legal department staff member says, "since this is their standard contract, adding clauses would probably be difficult." The outsourced work will involve customers' names and contact information. What is the most appropriate response for you to take?

1. Since it is the other party's standard contract, sign it as presented without change, and verbally request deletion of the data at the time the contract ends
2. Before signing, negotiate to add, via a memorandum or similar, the return or deletion of data at contract termination and acceptance of confirmation by document or on-site visit
3. Since the missing clauses represent significant risk, abandon this outsourcing arrangement altogether and proceed by performing all the work in-house
4. Omit the acceptance of audits since it is not used in practice, and only add, via a memorandum, the return or deletion of data at contract termination

Company A continues a practice of sending contractors a checklist once a year, requesting responses on the state of implementation along with supporting evidence. This year too, a response arrived from Company B, the data-entry contractor, and when you, the leader, reviewed it, every item was answered "implemented." However, among the requested evidence, only the item concerning annual training for employees was not submitted. Company B's staff contact changed partway through the year, and handover from the previous contact appears to have been incomplete. The responses and evidence status are as shown in the following table. What should be done first?

確認項目                  B社の回答       証跡の提出----------------------------------------------------従業者への年次教育の実施  実施            未提出アクセス権の定期棚卸し    実施            提出済再委託の有無              無              該当なし委託データの保管場所      社内サーバのみ  提出済事故時の連絡先の更新      更新済          提出済

1. Since subcontracting was answered as "none," remove the subcontracting clause from next year's contract
2. Since the reliability of the response is doubtful, conduct an unannounced on-site inspection and re-verify every item on the spot
3. Request that supporting evidence, such as attendance records, for the claimed training be submitted by a set deadline
4. Since all responses are "implemented," simply keep them on file as a record and conduct no further confirmation until next year

Company A's human resources department is considering outsourcing the tabulation and analysis of a company-wide workplace-environment survey to outside Company B. The data to be handed to Company B includes employees' names, affiliations, and survey responses. A staff member in HR asked you, the leader, "since data is being handed to an outside party, don't we need to obtain individual consent from every employee?" The outsourcing plan calls for defining confidentiality and safety-management measures in the contract and specifying the work location and storage method. Which of the following is the most appropriate explanation?

1. Since the contractor is also subject to the Act on the Protection of Personal Information, all management of the data after handover is entirely the contractor's responsibility, and the outsourcer has no duty of supervision
2. Providing personal data as part of outsourcing does not constitute third-party provision and does not require the individual's consent, but the outsourcer has a duty to supervise the contractor
3. Personal data that has not been pseudonymized or anonymized can never be handed to an outside party under any circumstances
4. Even outsourcing constitutes third-party provision, so outsourcing cannot proceed without obtaining individual consent from every employee

Company A's sales department uses a cloud file-sharing service (SaaS) to share quotations and proposals. The service provider has obtained ISMS certification and publishes its data center management structure. One day, a client contacted the company saying, "your quotation can be found in an internet search." Investigation revealed that when a staff member created a sharing link, it was issued with the default setting of "anyone with the link can view," and it had been reposted on an outside blog. A sales department staff member argues, "the problem lies with the provider's service, so the provider should be asked to investigate the cause and prevent recurrence." What is the most appropriate response here?

1. Since there appears to be a deficiency in the scope covered by the provider's certification, file a formal written complaint with the certification body
2. Since the use of cloud itself is the cause, ban the use of cloud services company-wide and move back to in-house servers
3. Since the user bears no responsibility when using SaaS, proceed to seek damages from the provider
4. Since the public-scope setting falls within the user's area of responsibility, review Company A's own default settings, link-issuance authority, and inspection practices

In renewing its contract with logistics contractor Company E, Company A organized the contract's clauses into a list. The review found that, while most necessary clauses are present, there are some clauses that are missing or limited. Company E handles the names and delivery addresses of Company A's customers and plans to subcontract part of the delivery work to a partner company. You, the leader, are organizing what to request in the renewal negotiation based on this list. The clause review results are as shown in the following table. Which of Company A's responses here is inappropriate?

条項                        定めの有無  内容の要点--------------------------------------------------秘密保持義務                有          契約終了後3年間存続目的外利用の禁止            有          委託業務以外での利用を禁止再委託                      有          事前の書面による承認が必要監査の受入れ                有          書面での確認のみ。立入りは不可事故発生時の報告            有          発覚後72時間以内に報告終了時のデータの返却・削除  無          定めなし

1. Since reporting within 72 hours of discovery may delay the initial response, consider separately setting a shorter deadline for the first report
2. Since a confidentiality obligation is defined, it is sufficient for the contractor to manage its subcontractors, and Company A need not learn the subcontractor's name or scope of work
3. Since there is no provision for the handling of data at termination, request that the scope and deadline for return or deletion, and submission of a completion report, be added to the renewed contract
4. Since on-site visits are not permitted, decide in advance the specific types of evidence to be submitted for confirmation by document

At 6 p.m. on a Friday, you, Company A's information security leader, received a call on your cell phone from a representative of contractor Company B. "A laptop used for the work is missing. It may have been left somewhere in our office, so it isn't confirmed as lost yet," the call said. The laptop may contain working files of customer data entrusted by Company A. Company B's representative says, "we'd like to make a formal report once things are clear." Under Company A's contract, a first report must be made within 2 hours of discovery, including a possible incident, and the receiving point is the information systems department's incident desk. What should be done first?

1. Instruct Company B's representative not to inform anyone, inside or outside the company, until the facts are confirmed
2. Since the loss is not yet confirmed, wait until Monday morning to report to a superior, and quietly monitor the situation without making contact in the meantime
3. Immediately submit a first report to the company's own incident desk, and request that Company B submit a formal first report in the prescribed format and identify the information on the laptop
4. Without waiting until the following week, go to Company B's office yourself and search for the laptop together with the representative

Company A's six-month outsourcing of campaign help-desk operations to Company B has ended. The work handled the names, addresses, and phone numbers of about 20,000 applicants. An email arrived from Company B stating, "All work has been completed. The entrusted data will be handled appropriately in accordance with our regulations." The contract stipulates that entrusted data must be returned or deleted at contract termination and that a completion report must be submitted. Upon checking with Company B, it explained that, in addition to the working data, daily backups are stored on a separate system. What is the most appropriate response for Company A?

1. Since whether deletion was carried out can be confirmed at next year's internal audit, for now simply keep a record of having received the report email
2. After confirming that the backups and working copies are also included in scope, request submission of a certificate of deletion by a set deadline
3. Since Company B is certified and trustworthy, end the outsourcing without requesting submission of a certificate of deletion
4. Since the backups were created by Company B for its own operational purposes, there is no need to include them in the scope of deletion

Company A conducted a targeted-attack email training exercise for the first time. When a training email disguised as a routine business message was sent to all employees, the open rate was 22%, while reports to the reporting desk reached only 6%. At the meeting where results were shared, a department head requested, "please give me a list of names of employees who opened it. I want to name and coach them individually and reflect it in performance reviews." You, the leader, feel you need to explain the purpose of the training again. The training is planned to continue once a year going forward. What is the most appropriate response for you to take?

1. Provide the department head with a list of names of employees who opened the email as requested, and cooperate with individual coaching and reflecting it in performance reviews
2. From next time, make the training email obviously identifiable as training so that the open rate goes down
3. Since a high open rate lowers morale within the company, do not publish the results and have only the person in charge keep them
4. Do not provide names; share the results as department-level trends, and use the method that caused the most opens as material for education that establishes reporting behavior

Company A conducted its second targeted-attack email training exercise and tabulated the results by department. The training email was disguised as a routine business message, and both opens and reports were measured. The report rate is the number of reports as a proportion of emails sent, and the time to first report is the time until the first report reaches the desk. The company-wide target was "an open rate of 15% or below," but you, the leader, believe the open rate alone should not be used to judge good or bad. The tabulated results are shown in the following table. Which of the following is the most appropriate reading of the results?

部門    送信数  開封数  開封率  報告数  報告率  初報までの時間--------------------------------------------------------------営業部  120     24      20%     40      33%     12分総務部  40      4       10%     2       5%      180分製造部  90      18      20%     27      30%     15分開発部  60      6       10%     3       5%      150分

1. The company-wide open rate is below the 15% target and the report rate has also improved, so all future training should be discontinued
2. For general affairs and development, whose open rate is low but whose report rate is also low and first report is slow, prioritize communicating the reporting desk and reporting procedure
3. Since general affairs has the lowest open rate, it can be said to be in the best state, and other departments should be evaluated as needing to emulate general affairs' approach
4. Since sales has the highest open rate, sales staff should undergo retraining including disciplinary action

Company A conducts annual information security training via e-learning, targeting regular employees only. In practice, temporary staff handling reception duties and contractor employees stationed on-site for development are also able to connect to the internal network and view customer data. A recent internal audit pointed out that "some of those who have access to information are not covered by the training." HR has raised the view that "since temporary staff and contractor employees are not our employees, isn't training their responsibility, of the staffing agency or the contractor?" You, the leader, are to present a corrective policy. What is the most appropriate approach?

1. For temporary staff, forgo in-house training and address it solely by reducing the scope of information they can view
2. Judge that, since contractor employees are under a confidentiality obligation via the outsourcing contract, in-house training is not particularly necessary
3. Leave them out of scope because of the different employment type, and verbally convey that training is left to the staffing agency or contractor
4. Provide training and pledges based on the company's own regulations to temporary staff and contractor employees as well, according to the extent of their access to the company's information

Company A revised its regulation on taking information outside the company. Under the revision, removal via USB drive, including personal drives, is now prohibited in principle, and sending files outside the company now requires application and approval from a supervisor via a designated cloud service. The secretariat posted the revised regulation to the intranet's regulation library and set the effective date as the 1st of the following month. However, at a meeting of on-site leaders, there were repeated comments such as "I didn't know it had been posted" and "I've never seen the new application screen." There are 3 weeks until the effective date. What should be done first?

1. Communication is already complete once posted to the regulation library and published internally, so no further action is particularly needed
2. Since it turned out the field did not know about it, cancel the revision of the regulation itself and revert to the previous operation
3. Before the effective date, deliver a summary of the changes, the effective date, and the new application procedure to those affected, and hold a session to confirm understanding
4. After the effective date, identify violators of the regulation and provide individual coaching and cautioning to those concerned

You, the leader at Company A, organized this fiscal year's information security education annual plan and results into a list. Upon organizing it, you found that some categories have been carried out while others have no plan at all. System administrators handle privileged IDs, and on-site contractor employees are in a position to view customer data. In creating next year's plan, you need to decide what to tackle first given limited work-hours. The organized results are shown in the following table. Which of the following is the most appropriate revision for next year's plan?

対象                時期           方法         受講率------------------------------------------------------新入社員            4月（配属前）  集合研修     100%中途入社者          随時           eラーニング  100%一般社員            10月           eラーニング  97%管理職              10月           集合研修     88%システム管理者      未実施         なし         なし派遣・委託先従業者  未実施         なし         なし

1. Set increasing general-employee education from once to twice a year as the top-priority item in next year's education plan
2. Prioritize adding, to next year's plan, education for system administrators and for temporary/contractor employees, for which no plan currently exists at all
3. Since new employees have a 100% attendance rate and it has become established, discontinue the in-person training for new employees altogether next year
4. Abolish the in-person training for managers, which has the lowest attendance rate, and consolidate all education for managers into e-learning

Company A administers a comprehension test at the end of its annual training, and this year too the company-wide results were tabulated by topic. The overall average correct-answer rate rose 2 points from the previous year. On the other hand, looking by topic, the gap is large, and it turns out that one particular topic alone has remained low. In the field, near-miss reports concerning removal via personal USB drive continue to be filed. You, the leader, are analyzing the results to reflect them in next year's education plan. The tabulated results are shown in the following table. What should be done first?

分野                    今年の正答率  前年の正答率--------------------------------------------------パスワードの管理        92%           90%不審メールの報告先      88%           60%情報の持出し申請の手順  41%           44%記録媒体の廃棄          78%           75%SNSでの発信             85%           83%

1. Since the correct-answer rate for reporting suspicious-email destinations has risen significantly, discontinue education and questions on that topic from next year and redirect that time to other topics
2. For the removal-application procedure topic, whose correct-answer rate has remained low, check whether the materials' explanation is insufficient and whether the actual application procedure itself is hard to use
3. Remove questions on the topic with a low correct-answer rate from next year's test, raising the overall average correct-answer rate
4. Since the overall average correct-answer rate has risen from the previous year, use the same materials and the same structure again next year

Company A created an incident-response procedure manual assuming a ransomware infection, but has not run a single exercise in the six months since creating it. The manual specifies the initial contact point, who decides on network isolation, and who decides on public disclosure, among other things. A live exercise that actually halts the business system is difficult to carry out because of the major impact on the production line. Outsourcing the exercise was considered, but this year's budget makes it difficult. You, the leader, still want to check whether the manual can actually be used. What is the most appropriate approach?

1. Since simply reading through the manual together is meaningless, wait to run any exercise until the budget can be secured, and then run a live exercise that halts the actual production business system
2. It is sufficient for the exercise to be run by the information systems department alone; participation by business departments is not necessary
3. Distribute a hypothetical scenario, gather the people concerned, and run a tabletop exercise in which each person confirms in turn the actions and decisions they would take next, surfacing outdated contact information and gaps in who is responsible for decisions
4. If a live exercise cannot be done, skip exercises altogether and substitute distributing the manual to everyone

At Company A, the person in charge managed information security training attendance records in a spreadsheet file on a personal PC. When that person transferred to another role and organized the files, it turned out that two years' worth of attendance records were missing. Unfortunately, a request arrived from outsourcing client Company F asking to "submit records showing the state of training provided to your employees." The training itself has been conducted every year, and the materials and announcement emails from that time still exist. You, the leader, need to address both this submission and future record management. What is the most appropriate approach?

1. Since the training itself has been conducted every year even though the records are gone, it is sufficient to explain verbally that it was carried out
2. Since the records exist only for audits and client confirmation, compile them freshly each time a request is received
3. Define in regulation who is responsible for keeping the records, where, and for how long, changing to a system that does not depend on one individual, and present Company F with the records that do exist along with a recurrence-prevention plan
4. Recreate a list of past attendees for the two missing years relying on the memory of attendees and others involved, submit it to Company F as the actual attendance record from that time, and continue handling future requests the same way

Company A has run targeted-attack email training for three consecutive years, reflecting the results in education each time. In the first round, many employees opened the email and almost no one reported it, so the company focused on communicating the reporting desk and explaining that reporting would not lead to blame. Separately from the training, the company also records the monthly average number of suspicious emails that employees actually receive and report to the desk. At the next committee meeting, you, the leader, are to report the 3-year trend to management. The trend is shown in the following table. What is the most appropriate content for the report?

回     開封率  報告率  初報までの時間  実際の不審メール報告-----------------------------------------------------------第1回  22%     6%      120分           月2件第2回  15%     18%     45分            月9件第3回  12%     34%     18分            月21件

1. Since the open rate is the only metric worth evaluating, report that no results have been achieved until the open rate falls below 10%
2. Since the report rate has risen but the open rate has not yet reached 0%, report that the three years of training have had no effect
3. Since the number of reports of suspicious emails actually received by employees keeps increasing, report that employee information security awareness is actually declining
4. Report that, along with the decline in the open rate, the rise in report rate and the shortening of time to first report have continued, and that actual suspicious-email reports have also increased, indicating that reporting behavior is becoming established

At Company A's annual information security committee meeting, you, the leader, report on the state of education. Past reports have centered on facts of implementation such as "e-learning was conducted, and the attendance rate was 97%," and management has repeatedly asked, "so has the company actually gotten stronger?" Next year, you are considering outsourcing part of the training and remaking the materials for topics with low comprehension, both of which require budget. On hand, you have the attendance rate, the comprehension test's correct-answer rate by topic, the training's report rate and time to first report, and the trend in the number and type of incidents. What is the most appropriate way to report to the committee?

1. Since management does not need fine detail, skip the trend in metrics, next year's plan, and the required budget, and report only the conclusion that no major problems have occurred
2. Present the attendance rate along with the comprehension test's correct-answer rate by topic, the training's report rate and time to first report, and the trend in incident count and type, and propose what to change next and what resources are needed
3. Since the effect of education cannot be expressed in numbers, report only the number of sessions held and the number of participants
4. Show only the attendance rate, and explain that falling short of 100% is due to low awareness in the field

Company A conducts an internal information security audit once a year. This year's audit scope includes the access-rights management mechanism that the information systems department itself designed and operates. At a meeting to decide who will perform the audit, the secretariat proposed, "since the information systems department knows the mechanism best, it would be efficient to have that department's chief handle the audit." The chief himself also says, "I could check it quickly." You, the leader, have concerns about this proposal. What is the most appropriate approach?

1. Since internal audit is merely a formal activity, skip it this time and substitute the results of an external examination by a certification body
2. Since independence is merely a formal requirement, proceed with the secretariat's proposal as is, and it is sufficient to note in the audit report that independence was considered
3. Since the staff member most familiar with the mechanism is more likely to find deficiencies, proceed with the secretariat's proposal and have the information systems department's chief handle it
4. Have someone who does not belong to the audited department, the audit department, or an outside specialist take charge, with the information systems department in the position of providing explanations and evidence

Company A is starting internal information security audits this year for the first time, and a staff member from general affairs has been appointed as auditor. That staff member says, "I plan to visit each department and raise anything that catches my attention on the spot." The company has an information security regulation and various procedure manuals, and contracts with outsourcing partners include clauses on safety management. Audit results are to be reported to management, and corrective action requested for any findings. You, the leader, are concerned that the audited departments will not find this approach convincing. What should be done first?

1. Obtain another company's audit report and adopt the findings written there as-is as this company's own findings
2. Visit each department, list what catches your attention, and select the items that seem important as findings
3. Define in advance the audit's scope and the audit criteria against which good and bad will be judged (the company's own regulations, procedure manuals, contract clauses, laws)
4. Since notifying departments in advance lets them prepare, conduct the audit as a surprise without notifying the scope or schedule, citing only what is observed on the spot as findings

Company A manages internal-audit findings in a list, checking the category, corrective deadline, and progress each month. The categories are "nonconformity," which fails to meet a regulation or requirement, and "opportunity for improvement," which is not a violation but could be done better. Today is October 20, and you, the leader, have organized the situation ahead of the progress meeting. Some items are not progressing, and some have even passed their deadline. The current status is shown in the following table. Which item should be tackled first?

No  指摘事項                            区分        是正期限    状況--------------------------------------------------------------------1   退職者のアカウントが3件残存         不適合      9/30        未（担当が未定）2   委託先の年次報告書が未読のまま保管  不適合      11/15       対応中3   異動時の旧権限の削除手順が未整備    不適合      11/30       対応中4   教育記録の保管期間が規程に未記載    改善の機会  次回改訂時  未5   会議室での書類の置きっぱなし        改善の機会  随時        済

1. Concentrate on completing first the procedure development for No.3, which still has days remaining until its deadline
2. Begin work on deleting the retired employee's account for No.1, which is past its deadline and still has no one assigned
3. For No.5's issue of documents being left out in the meeting room, issue a renewed company-wide caution notice
4. Begin work on aligning the regulation's wording for No.4's training-record retention period, ahead of other items

Company A's sales department received a finding in last year's internal audit that "access rights in the former department of a transferred employee had not been removed." Sales removed the rights of the individual concerned on the spot, reported to the audit department that "the staff member involved was cautioned," and treated it as corrected. Yet this year's audit produced the same finding on 3 separate cases. Investigation showed that transfers are processed in the HR system, but removal of access rights operates on a basis where each department's staff apply for removal whenever they happen to notice, and the procedure manual does not describe a removal step at all. You, the leader, want to stop the recurrence this time for good. What is the most appropriate approach?

1. Since it has recurred despite last year's caution, discipline the staff member who neglected to remove the former access rights, based on the work rules
2. Perform a batch inventory and removal of unnecessary access rights right before the audit each year, so as to avoid the finding the following year too
3. Since this finding recurs every year, strongly request the audit department to exclude it from findings as unavoidable in practice
4. Build removal of former access rights into the transfer procedure as a mandatory step, and confirm its execution through a quarterly inventory

Company A's sales department is scheduled to undergo an internal audit next week covering "removal and storage of customer information." In practice, some staff in sales, finding the official application procedure cumbersome, have been saving customer lists to personally contracted cloud storage without obtaining a supervisor's approval. The sales department head instructed at a department meeting, "since a poor evaluation from the audit would be a problem, don't bring that up unless asked." You, the leader, are unsure whether to go along with this instruction. Submission of a corrective plan will be required after the audit. What is the most appropriate approach?

1. Advise the department head to explain the actual situation and the number of cases without concealment, together with the underlying cause — that the official procedure is hard to use — and a corrective plan
2. Delete all files on the personally contracted cloud storage before the audit date, and explain as though that practice never existed
3. Follow the department head's instruction, answer only what is specifically asked in a perfunctory way, and do not raise the actual situation from your side
4. Since the audit is merely a formality, limit yourself to submitting the requested records, and exclude staff who know the actual situation from attending

In Company A's internal audit, the auditor interviewed a staff member in the business department about operating practices and also checked for supporting records. The staff member explained for every item that "it is carried out according to regulation," but the state of records varied by item. The auditor believes that explanations and records must be cross-checked to reach a judgment. The results of the check are shown in the following table. What is the most appropriate judgment for the auditor to make?

確認事項                            現場の説明    記録の状況------------------------------------------------------------特権IDの利用は都度申請し承認を得る  実施している  申請書はあるが承認欄が空欄サーバ室の入退室を記録する          実施している  入退室記録あり委託先への情報の持出しを台帳に記録  実施している  台帳がなく担当者の記憶のみ従業者教育を年1回実施する           実施している  受講記録あり

1. For items lacking records, have the auditor interview the staff member in detail and create a new ledger, treating it as-is as the audit trail
2. Since the field explains that it is being carried out, judge there to be no problem regardless of whether records exist
3. For the application form with a blank approval field and for removals relying on memory with no ledger, cite insufficient audit trail as a finding, since implementation cannot be confirmed
4. For entry/exit records and training, for which records do exist, likewise cite a finding because the staff member's explanation alone is insufficient

Company A conducts an internal information security audit every year and produces an audit report. However, the report is merely kept on file by the secretariat, with no venue for reporting it to management, and it is not reflected in the following year's plan or budget. As a result, nearly the same findings appear year after year, and voices in the field say "nothing ever changes anyway." This year's audit has also just finished, and you, the leader, have just received the report. What is the most appropriate approach?

1. Judge that, since the audit results are a matter of on-site operations, there is no need to report them to management
2. Since an audit is a checking activity, consider PDCA to have completed one cycle simply by having performed the audit
3. Since the same findings appearing every year is due to the auditor's fixed perspective, rotate the audit items each year so the same findings do not recur
4. Establish a management review venue where management reviews the audit results, incident occurrences, and degree of goal achievement, and reflect its decisions in next year's plan and resource allocation

At the request of a client, Company A is pursuing ISMS certification for the first time. The secretariat staff member proposes, "since the goal is to pass the examination, let's model the regulation on another company's polished one to make it look ideal, and also redo the records to look neat for the examination." Actual operations are looser than the draft regulation in places — for example, entry/exit records are entered in weekly batches rather than every time. The examination checks both the regulation and actual operations. You, the leader, have concerns about this approach. What is the most appropriate approach?

1. Abolish the regulation to match on-site operations, leaving matters to case-by-case judgment
2. Shape the regulation to match what the company can actually carry out, so that the records generated by day-to-day operations can be submitted as-is as evidence
3. For the parts where regulation and operations diverge, operate according to the regulation only during the examination period, then revert to the previous operations once the examination ends
4. Since the goal is to pass the examination, draft a new, ideal-looking regulation, tidy up the records for the examination as well, and submit them

Company A underwent an external examination and received a report from the examination body. The report categorizes findings, and the required response and deadline differ by category. The secretariat staff member says, "since there are many items, perhaps we should only address the ones with an explicit deadline." You, the leader, decide to organize what each category means before deciding on a response policy. The report's contents are shown in the following table. Which of Company A's responses would be inappropriate?

区分          件数  求められる対応                        期限--------------------------------------------------------------重大な不適合  1     原因分析と是正計画の提出、是正の完了  30日以内に計画提出軽微な不適合  3     是正処置の実施                        次回審査まで改善の機会    5     対応は任意（推奨事項）                期限なし

1. Since the 5 opportunities for improvement have no deadline and response is optional, do not keep any record of them and do not even consider them
2. Establish an in-house mechanism to follow up on whether corrective actions were carried out by their deadlines
3. Since the 3 minor nonconformities also require correction, assign a person in charge and an internal deadline to each
4. For the major nonconformity, begin cause analysis immediately and prepare to submit a corrective plan within 30 days

Company A's internal audit produced a nonconformity finding that "the core system's operation logs are retained for only one week, so if fraud is suspected there is no way to trace back." Correcting this requires additional storage and a configuration change, estimated to cost several million yen. The information systems department responded, "we cannot proceed since it is not budgeted for this fiscal year," and only 2 months remain until the corrective deadline. You, the leader, have requested action three times with no change in the situation, and feel this cannot be resolved through inter-departmental coordination alone. What is the most appropriate approach?

1. Treat it as the information systems department's own decision to accept the risk, and have the leader process it as corrected
2. Ask the audit department to withdraw this finding for now, and arrange for it to be raised again with the same content next fiscal year once budget is available
3. Since nothing can be done without budget, keep extending the corrective deadline and report the status as "in progress"
4. Organize the anticipated impact if tracing remains impossible, the resources required, and who would accept the risk if the response is deferred, then escalate to management for a decision