問68
頻出度★★★
全社を適用範囲として ISMS を導入する場合の情報セキュリティ方針に関する記述のうち, 適切なものはどれか。
平成29年度 秋期 ITパスポート試験 問68
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 68
Incorrectア
Even within the same industry, each company holds different information assets, has different business content, faces different anticipated risks, and follows different management directions, so the wording of the policy is unique to each company. Being in the same industry alone does not make the content identical.
Incorrectイ
Concrete, technical rules such as PC configuration rules are defined in the lower-level standards or procedures beneath the policy. The information security policy is a higher-level document that expresses the philosophy and purpose of the effort, not the individual configuration rules themselves.
- ウ
正解 The information security policy (basic policy) is the top-level document that expresses how an organization intends to address information security. Under an ISMS, it must be established and approved under the leadership of top management (the executive level) and communicated to all employees. When the scope covers the entire company, it is all the more necessary for management to take responsibility and set a single, company-wide policy. Therefore choice ウ — that it must be established by top management — is appropriate.
Incorrectエ
When the scope is the entire company, the basic policy should be defined uniformly across the whole company. If each department separately formulates its own individually optimized policy, company-wide consistency is lost, which contradicts the premise of company-wide application. Department-specific circumstances are supplemented by lower-level regulations.
ここがポイント
- The information security policy (basic policy) is the top-level document of an ISMS; it is established and approved by top management and communicated across the whole company.
- There is a hierarchy of policy (philosophy and purpose) → standards → procedures; specific configuration rules are defined not in the policy but in the lower-level standards and procedures.
用語