平成28年度春期 ITパスポート試験問73

This question's explanation and your answers so far.

問73

頻出度★★★

情報セキュリティマネジメントシステムを構築した企業において, 情報セキュリティ方針を改訂したことを周知する範囲として, 適切なものはどれか。

出典　平成28年度春期 ITパスポート試験問73

解説

問 73

Incorrectア
Limiting it to 'employees of departments that handle confidential information' is too narrow. The information security policy is a basic policy that applies to the entire organization and all employees, not to specific departments, so employees who do not directly handle confidential information are also covered.
Incorrectイ
'Management (executives)' are in the position of approving and declaring the policy, but communicating it only to management will not make the policy followed on the ground. The audience for communication is everyone who must actually comply with the policy, so limiting it to management is wrong.
ウ
正解 The information security policy is the foundational basic rule underpinning an organization's security activities, and in ISMS the principle is to communicate it to 'all employees and relevant external parties'. If a revised policy is not communicated to that same scope, some people will keep acting under the old rules, undermining its effectiveness. External parties such as contractors and business partners are also within the scope of the policy, so the correct answer is 'ウ'.
Incorrectエ
'Security administrators' are responsible for operating and managing the policy, but communicating it only to administrators will not reach the whole organization. The policy must be conveyed broadly to all employees and external parties, so this scope is too narrow and inappropriate.

ここがポイント

The information security policy is a basic rule for the entire organization, and communicating it to all employees and to relevant external parties such as contractors and business partners is a principle of ISMS.
Not only when the policy is newly established but also when it is revised, it must likewise be communicated to all employees and relevant external parties, and the scope of communication must not be limited to only some of them.

用語

解答問73ウ