問75
頻出度★★★
情報セキュリティポリシに関する文書を, 基本方針, 対策基準及び実施手順の三つに分けたとき, これらに関する説明のうち, 適切なものはどれか。
平成26年度 春期 ITパスポート試験 問75
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 75
- ア
正解 An information security policy is made up, from the top down, of three levels: the basic policy, the countermeasure standards, and the implementation procedures. The basic policy at the top is the document in which management declares the organization’s stance on information security, its purpose, and its scope, and it is the basis for every document below it. The countermeasure standards come next: in order to realize that basic policy, they spell out what is to be protected and what measures are to be taken, as regulations and rules for each area, and they are always formulated with the basic policy as their higher-level basis. The implementation procedures at the bottom are manuals that break what the countermeasure standards define down to how the work is actually carried out in the field. Choice ア correctly states this top-down direction, in which upper documents are developed into lower ones — that is, the relationship in which, based on the basic policy established by management, the countermeasure standards are formulated. It is therefore appropriate.
Incorrectイ
The direction of the hierarchy is reversed. The implementation procedures are the lowest-level documents and the basic policy is the highest-level one. Building management’s basic policy by gathering together the procedures used in the field would turn the organization’s policy into a mere endorsement of the status quo, and the basic policy could not play its role as the unified guidance that management sets out. The basic policy is decided first, as the will of management, and the procedures are then put in place in response to it.
Incorrectウ
This choice also reverses the direction. The countermeasure standards are documents at a higher level than the implementation procedures, and they are formulated in response to the basic policy. The implementation procedures are the product of making the countermeasure standards concrete at the level of field work, so an order in which the standards are created on the basis of the procedures contradicts the relationship among the three levels.
Incorrectエ
The countermeasure standards are documents subordinate to the basic policy, so they cannot serve as the basis for it. The basic policy is the top-level document that management establishes first; it is not derived from the lower-level countermeasure standards. This description gets the upper-lower relationship backwards.
ここがポイント
- The three levels of an information security policy: the basic policy (Why — the policy declared by management) → the countermeasure standards (What — regulations for each area) → the implementation procedures (How — manuals for the field). A top-down structure in which the upper document is the basis for the lower one.
- The basic policy is formulated and approved by management and is communicated throughout the whole organization. Also keep in mind the distinction that, in the narrow sense, the term information security policy sometimes refers only to the basic policy and the countermeasure standards.
用語