問54
頻出度★★★
企業の情報セキュリティポリシの策定及び運用に関する記述のうち，適切なものはどれか。
平成21年度 春期 ITパスポート試験 問54
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 54
Incorrectア
The concrete contents to be configured in each security countermeasure software are defined in the procedures, the lowest layer of the policy structure. The policy layers (the basic policy and the standards) state what must be protected and how things should be, in a form that does not depend on any particular product or technology, so treating the definition of settings for individual software as a requirement of policy formulation is inappropriate.
- イ
正解 The correct answer is イ. An information security policy is not a technical document written only by engineers; it is a declaration of management's intent that says how the company will protect its information assets. Therefore, top management itself explaining the company's stance and approach to employees, and taking the lead in spreading it through the organization, is the basic premise for formulating and operating the policy. If employees do not sense that management is serious, then no matter how fine the documented policy is, people on the front line will not treat it as their own concern, and it will end up as an empty formality. In management systems such as JIS Q 27001 as well, commitment from management (involvement and a statement of responsibility) and communication to all employees are required, which is worth keeping in mind.
Incorrectウ
The standards for the conduct and judgment to be observed correspond to the standards layer in the middle of the three-layer structure. As a rule, formulation proceeds from the upper layers down to the lower ones, and what is established first is the basic policy declared by top management (a statement of why and what is to be protected). The order here is reversed, so it is wrong.
Incorrectエ
Deciding which products to introduce is work in the concrete implementation stage (the procedures), carried out after the policy and the standards have been set. If a policy is built around a product first, it ends up being driven by the vendor's circumstances rather than by business goals. As a statement about the formulation and operation of a policy it misses the point, so it is inappropriate.
ここがポイント
- An information security policy has a three-layer structure. From the top: the basic policy (management's statement of intent — why and what is protected) → the standards (the standards for the conduct and judgment to be observed) → the procedures (concrete setting values and work steps). Formulation must always proceed from the upper layer down to the lower ones.
- What decides whether a policy succeeds is the commitment of top management. It is a required condition that top management take the lead in explaining the company's thinking and communicating it company-wide, while product selection and the settings of individual software are not the policy itself but belong to the procedures layer.
用語