問62
頻出度★★★
ISMSの情報セキュリティ方針に関する記述として, 適切なものはどれか。
平成27年度 秋期 ITパスポート試験 問62
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 62
- ア
正解 The information security policy (basic policy) is the top-level statement of intent showing how an organization addresses information security. In an ISMS, top management, which leads the organization, is required to establish it and to approve and support it. Because top management takes responsibility for the policy, its legitimacy and effectiveness as a company-wide effort are ensured. Therefore choice ア, “the information security policy must be established by top management,” is appropriate.
Incorrectイ
The basic-policy portion of the information security policy is meant to show the organization's stance to business partners, customers, and society, so it is generally disclosed to outside parties instead. “Must not be disclosed to outside parties” is incorrect (this confuses it with the point that detailed control standards and implementation procedures are kept non-public).
Incorrectウ
The information security policy should be reviewed periodically in line with changes in the business environment, threats, and laws and regulations, and revised as needed (continual improvement through PDCA). “Once established, it cannot be changed” is incorrect.
Incorrectエ
The information security policy must be made known to and complied with by all employees, regardless of the type of information they handle. Even employees who do not handle personal information or confidential information are included, so “it is acceptable not to make it known” is incorrect.
ここがポイント
- The information security policy (basic policy) is the organization's top-level statement of intent, established and approved by top management.
- As a basic policy, the policy may also be disclosed to outside parties; it should be reviewed in response to environmental changes (PDCA) and made known to and complied with by all employees.
用語