問83
頻出度★★★
情報セキュリティ基本方針の説明として, 適切なものはどれか。
平成23年度 秋期 ITパスポート試験 問83
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 83
Incorrectア
An information security basic policy is not something that stays unchanged once it has been decided. An information security management system (ISMS) is built on the premise of continual improvement through the PDCA cycle (Plan, Do, Check, Act), and the policy too is subject to periodic review. When the underlying premises change — the business content or organizational structure is altered, new technologies or services are introduced, new threats emerge, or laws and regulations are revised — the policy must be revised so that it matches reality. The statement that it should not be changed even when things change runs directly counter to this idea of continual improvement, so it is wrong.
- イ
正解 The correct answer is イ. An information security basic policy (information security policy statement) is the top-level document of the information security policy framework: it declares the organization's basic thinking on how it will address information security, together with its purpose, its scope of application and its structure of responsibility. An information security policy is generally organized into three levels: at the top the “basic policy” (a declaration of the guiding ideas — why and for what purpose information is protected), below it the “control standards” (the rules and requirements stating what must be done in order to protect information), and below that the “implementation procedures” (concrete manuals stating how the work is actually carried out). The basic policy sits at the most abstract of these levels and does not go into individual technical measures. It is also a norm that applies to the whole company and involves allocating the necessary budget and personnel, so it is essential that top management (the head of the organization) approve it and take responsibility for it personally; this is what secures its effectiveness across the entire organization. Furthermore, in order to show the organization's stance to stakeholders such as business partners, customers and shareholders and thereby earn their trust, it is normally communicated within the company and also made public outside it. Choice イ satisfies all three of these characteristics — that it “expresses the organization's stance toward information security”, that it “is approved by top management”, and that it “is made public” — so it is an appropriate description of the basic policy.
Incorrectウ
Priority initiatives for expanding a security business are about how to sell more security-related products and services — a matter of business strategy and management planning. Even if they are disclosed to shareholders and the general public, they belong to documents such as a management policy or a mid-term business plan. What an information security basic policy deals with is the stance the organization takes in protecting the information assets it holds, not business development aimed at earning revenue. It has only the single point of being made public in common with the correct choice, but what it declares is something entirely different, so it is wrong.
Incorrectエ
A document that describes specific security measures based on the organization's security philosophy corresponds to the “control standards” that sit one level below the basic policy, or to the “implementation procedures” below those. The opening phrase “based on the organization's security philosophy” itself indicates that another document (namely the basic policy) exists above it, which confirms that this choice is not the basic policy itself. The basic policy is the level that declares philosophy and stance; it does not go so far as to write out the content of specific measures. The statement is off by one level in the hierarchy, so it is wrong.
ここがポイント
- The three levels of an information security policy — the top-level “basic policy” (a declaration of the organization's guiding ideas, purpose, scope of application and structure of responsibility), the middle-level “control standards” (the rules and criteria to be observed), and the lower-level “implementation procedures” (concrete working steps). Specific measures and procedures are handled not by the basic policy but by the lower levels.
- Requirements for the basic policy — because it applies company-wide and involves allocating budget and personnel, it is approved by top management (the executives), who take responsibility for it, and it is made public both inside and outside the company in order to earn the trust of stakeholders. It is also reviewed periodically in line with the ISMS PDCA cycle and revised as the business environment, technology, threats and laws change.
用語