問78
頻出度★★★
ISMSを構築する組織において, 企業の経営方針に基づいて情報セキュリティ基本方針を策定した。これは, ISMSのPDCAサイクルのどのプロセスで実施されるか。
平成26年度 秋期 ITパスポート試験 問78
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 78
- ア
正解 The correct answer is ア (P = Plan). An ISMS (Information Security Management System) is operated using the PDCA cycle, and the P (Plan) stage decides the overall framework of what to protect, how far to protect it, and how. Specifically, formulating an information security basic policy aligned with the company's management policy, determining the scope of the ISMS, carrying out risk assessment, and selecting controls all belong to the P stage. The situation in the question, formulating an information security basic policy based on the company's management policy, is the act of first setting the security direction for the whole organization, and it becomes the foundation for all of the later D, C, and A stages. Therefore it is carried out in the P process.
Incorrectイ
D (Do = implementation and operation) is the stage where the basic policy and controls decided in P are actually put into practice. Preparing rules and manuals, training employees, and running concrete measures such as access control and anti-virus protection belong here. Creating the basic policy itself is not D, but the earlier stage P.
Incorrectウ
C (Check = monitoring and evaluation) is the stage for confirming whether the operating ISMS is working according to the policy and objectives. Internal audits, reviews of effectiveness, and management reviews by executives belong here. The basic policy, which serves as the yardstick for evaluation, is assumed to already exist by the time of C; it is not formulated at this point.
Incorrectエ
A (Act = review and improvement) is the stage for taking corrective and preventive actions on the problems found in C, so that the ISMS is continually improved. The basic policy may well be revised at this stage, but the first act of newly formulating it based on the management policy belongs to P, not to A.
ここがポイント
- Division of roles in the ISMS PDCA cycle: P = formulating the basic policy, determining the scope, carrying out risk assessment and selecting controls; D = implementation and operation (training, putting measures into practice); C = checking through internal audits and management reviews; A = continual improvement through corrective action.
- The information security basic policy is set by top management in alignment with the company's management policy, and it is the starting point for building an ISMS. Remember the phases separately: formulating it belongs to the planning stage (P), while revising it belongs to the improvement stage (A).
用語