問61
頻出度★★★
情報セキュリティの文書を詳細化の順に上から並べた場合，①～③に当てはまる用語の組合せとして，適切なものはどれか。 上から下へ3段に分かれた三角形（ピラミッド）があり，上段が①，中段が②，下段が③である。
平成22年度 春期 ITパスポート試験 問61
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 61
Incorrectア
① is correctly the Basic Policy, but ② and ③ are swapped. The Implementation Procedures are concrete procedure manuals for carrying out, on the front line, the rules laid down in the Countermeasure Standards, and they are the bottom-tier document, more detailed than the Countermeasure Standards. Putting the Implementation Procedures in the middle tier and the Countermeasure Standards at the bottom would hang a more abstract document beneath a more detailed one, which contradicts the direction of the pyramid: abstract at the top, detailed at the bottom.
- イ
正解 The correct answer is “イ ① Basic Policy ② Countermeasure Standards ③ Implementation Procedures”. An information security policy is generally represented as a three-tier pyramid: the higher the tier, the more abstract and company-wide it is, and the lower the tier, the more concrete and detailed it is. The top tier, ① the Basic Policy (Information Security Basic Policy), is a document that declares why the organization works on information security and what stance management takes toward it; it only states the scope and the persons responsible, and does not go as far as individual methods. The middle tier, ② the Countermeasure Standards, sets out, area by area, the rules that must be followed in order to realize that basic policy — for example, how many characters a password must have at minimum, or that taking external storage media off site requires approval. It specifies “what must be protected and to what level”. The bottom tier, ③ the Implementation Procedures, are the concrete work manuals and procedure documents used to carry out the countermeasure standards on the front line, written in detail down to which screen to operate and how, and to whom and how to apply. Because the question specifies that the documents are “arranged from top to bottom in order of increasing detail”, the highly abstract Basic Policy is ①, the Countermeasure Standards come next as ②, and the most detailed Implementation Procedures are ③. The only combination with this order is “イ”.
Incorrectウ
It is wrong to place the Countermeasure Standards at the top and the Basic Policy below them. The Basic Policy is the top-tier document in which management declares the stance of the organization as a whole, while the Countermeasure Standards are a lower-tier document that takes that basic policy and turns it into concrete rules. Here the upper and lower levels are reversed, which would create the impossible relationship in which the Basic Policy has to follow the Countermeasure Standards.
Incorrectエ
The order of all three tiers is wrong. It places the Basic Policy — the most abstract document, the one the other documents rest on — at the bottom tier, and the most detailed Implementation Procedures in the middle tier. So it is not merely the reverse of the order of increasing detail: the hierarchical relationship itself collapses. The Basic Policy must be the top-tier document that the other two documents are premised on.
ここがポイント
- An information security policy is made up of three tiers: Basic Policy (Why — the organization's declaration) → Countermeasure Standards (What — the rules and levels to be observed) → Implementation Procedures (How — concrete work steps and manuals). The higher the tier, the more abstract it is and the less frequently it changes; the lower the tier, the more detailed it is and the more it is revised as conditions on the front line change. It is also worth remembering that an information security policy in the narrow sense refers to the upper two tiers (Basic Policy + Countermeasure Standards) and does not include the Implementation Procedures.
- For a question that asks how hierarchical documents are ordered, first check whether the question asks for the order of increasing detail or the order from most abstract downward, then apply the principle that a pyramid diagram is abstract at the top and detailed at the bottom. Memorizing who each tier is written for (Basic Policy = management's declaration to the whole company, Countermeasure Standards = rules aimed at administrators, Implementation Procedures = procedure manuals aimed at the staff who do the work) makes it harder to get the order wrong.
用語