問71
頻出度★★★
企業における ISMS の活動において, 自社で取り扱う情報資産の保護に関する基本的な考え方や取組み方を示したものはどれか。
平成28年度 秋期 ITパスポート試験 問71
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 71
Incorrectア
A BCP (Business Continuity Plan) is a plan for continuing and quickly recovering critical operations when business is interrupted by a disaster, accident, or the like. It is not a document that expresses the basic philosophy for protecting information assets, so it is incorrect.
Incorrectイ
The ISMS requirements (those specified by JIS Q 27001 / ISO/IEC 27001) are the standard-level conditions that must be met in order to build and operate an ISMS; they are requirements imposed by the standard itself. They are not a document that declares the company’s own basic philosophy, so this is incorrect.
Incorrectウ
PDCA is a management cycle (a method) that repeats Plan, Do, Check, and Act to continually improve the ISMS; it is not a document that expresses the basic philosophy, so it is incorrect.
- エ
正解 The correct answer is “エ Information Security Basic Policy”. The Information Security Basic Policy is the top-level document in which management declares the organization’s basic philosophy and approach for protecting information assets, and it sits at the apex of the ISMS document hierarchy. What the question asks for — the item that expresses the basic philosophy and approach regarding the protection of the information assets handled by the company — is exactly this Information Security Basic Policy itself. Based on this policy, more specific control standards and implementation procedures are then defined.
ここがポイント
- Information Security Basic Policy = the top-level document in which an organization declares its basic philosophy and approach for protecting information assets (established by management).
- The ISMS document system is structured as a hierarchy of policy (basic policy) → control standards → implementation procedures, with the policy positioned at the top.
用語