問62
頻出度★★★
ISMS に関するトップマネジメントの考え方や基本原理を示す公式な文書はどれか。
平成29年度 春期 ITパスポート試験 問62
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 62
Incorrectア
Information security audit standards are the criteria a third party uses as the basis for judgment when auditing and evaluating whether information security countermeasures are properly implemented and operated. They are not the document that states top management’s philosophy and basic principles themselves, so this is incorrect.
Incorrectイ
Information security implementation procedures are the lowest-level procedure manual specifying how to concretely carry out the countermeasure standards in practice. They prescribe details at the level of day-to-day work and are not the document that states executives’ basic policy, so this is incorrect.
Incorrectウ
Information security countermeasure standards are the intermediate-level document that defines the concrete rules of “what to protect and how to counter it” in order to realize the policy. They are regulations created in response to the policy, not the top-level document that states top management’s basic principles, so this is incorrect.
- エ
正解 The correct answer is “エ Information security policy.” The information security policy (information security basic policy) is the top-level official document that states — to the whole organization and even externally — how the organization’s top management (executives) approaches information security, including its philosophy, objectives, and basic principles. The documents of an ISMS (Information Security Management System) are structured top-down in the hierarchy “basic policy (information security basic policy) → countermeasure standards → implementation procedures”; the policy sits at the top and serves as the basis for all subsequent countermeasure standards and procedures. Therefore, the document that states top management’s philosophy and basic principles is the “information security policy,” so エ is correct.
ここがポイント
- The ISMS document hierarchy is ordered as “information security basic policy → countermeasure standards → implementation procedures,” with the policy at the top, stating top management’s philosophy and basic principles.
- Memorize them by distinguishing their roles: “policy = basic principles,” “countermeasure standards = concrete rules,” “implementation procedures = work level,” and “audit standards = basis for evaluation.”
用語