問80
頻出度★★★
ISMSに関する記述のうち, 適切なものはどれか。
平成27年度 秋期 ITパスポート試験 問80
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 80
Incorrectア
The ISMS management cycle is a continuous effort based on PDCA and keeps running even in normal times. It is not a one-off response that begins only after a security incident occurs and ends once it is resolved, so this is wrong.
Incorrectイ
In principle an ISMS covers the whole organization (or a clearly defined scope of application) and is built and operated with the involvement of management. The restriction that it must always be done department by department is wrong.
- ウ
正解 The starting point of an ISMS (Information Security Management System) is to identify the information assets that must be protected, assess the risk of each, and then decide on the risk treatment (reduction, avoidance, transfer, acceptance, and so on). Choice ウ states exactly this essence, so it is appropriate. An ISMS is a mechanism that continuously improves by running the PDCA cycle (Plan → Do → Check → Act); the core of its planning stage is identifying assets and deciding on risk assessment and risk treatment.
Incorrectエ
The information security basic policy is a higher-level document in which management declares the organization-wide philosophy, purpose, and direction; it does not describe the specific measures themselves. The individual concrete measures are defined in the lower-level control standards and implementation procedures, so this is wrong.
ここがポイント
- The core of an ISMS is “identify information assets → risk assessment → decide on risk treatment”, and it is a mechanism that continuously improves through the PDCA cycle.
- An information security policy has a hierarchical structure (basic policy = philosophy and direction / control standards and implementation procedures = concrete measures), and the policy itself does not describe specific measures.
用語