問81
頻出度★★★
組織の活動に関する記述a～dのうち，ISMSの特徴として，適切なものだけを全て挙げたものはどれか。 a 一過性の活動でなく改善と活動を継続する。 b 現場が主導するボトムアップ活動である。 c 導入及び活動は経営層を頂点とした組織的な取組みである。 d 目標と期限を定めて活動し，目標達成によって終了する。
平成27年度 春期 ITパスポート試験 問81
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 81
Incorrectア
Statement a is correct, but b is wrong. An ISMS is not a bottom-up activity led by the front line; it is a top-down activity in which top management sets the policy and deploys it across the entire organization. Day-to-day operation by the front line is essential, but the driving force is top management, so option (ア), which includes b, is inappropriate.
- イ
正解 The correct answer is (イ) (a, c). An ISMS (Information Security Management System) is a mechanism that an organization builds and keeps running to protect its information assets, and it achieves continual improvement by repeating the PDCA cycle of Plan, Do, Check, and Act. Therefore, statement a — that it is not a one-time activity but continuously carries out improvement and activities — is an appropriate characteristic of an ISMS. In addition, an ISMS is a top-down effort in which top management establishes and declares the information security policy, allocates the necessary resources, and rolls it out across the whole organization, so statement c — that its introduction and activities are an organization-wide effort headed by top management — is also appropriate. Only a and c are appropriate, so (イ), which lists exactly these two and nothing more, is the correct answer.
Incorrectウ
Neither b nor d is a characteristic of an ISMS. As explained above, b reverses who drives the effort (it should be top-down), and d is wrong in saying that the activity ends once the goal is achieved, whereas an ISMS is a mechanism premised on continuous operation and improvement with no end point. This option contains no appropriate statement at all, so it is wrong.
Incorrectエ
Statement c is correct, but d is wrong. Setting a deadline and finishing once the goal is met is the nature of project-type work, whereas an ISMS is a permanent management system that continues by running the PDCA cycle. Because threats and the business environment keep changing, operation and review must continue even after the goals have once been met.
ここがポイント
- An ISMS is a continual-improvement mechanism that repeats the PDCA cycle (Plan, Do, Check, Act); it is not a one-time activity with a deadline that ends when the deadline is reached.
- An ISMS is a top-down, organization-wide effort led by top management, which formulates and declares the information security policy; it is not a bottom-up activity led by the front line.
用語