問70
頻出度★★★
ISMS における情報セキュリティ方針の説明として, 適切なものはどれか。
平成30年度 秋期 ITパスポート試験 問70
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 70
Incorrectア
Defining the obligations that businesses handling personal information must observe is a description of the “Personal Information Protection Act,” which is a different thing from the information security policy in an ISMS.
Incorrectイ
Presenting the specific procedures for ensuring information security is the role of procedure documents (control standards / implementation procedures), not a description of the information security policy, which is the top-level basic policy.
- ウ
正解 In an ISMS, the information security policy is the top-level document established by the organization's top management. It declares the whole organization's intent and stance toward information security and gives direction to the related efforts. The key point is that it is not specific setting values or procedures, but a basic policy that expresses the organization's will. Therefore, choice ウ — “It indicates the organization's intent regarding information security and gives it direction” — is correct.
Incorrectエ
Defining a server's security setting values belongs to technical documents at the level of configuration standards / baselines, and does not amount to a description of the information security policy, which indicates the organization's intent and direction.
ここがポイント
- The information security policy is the top-level document by which top management indicates the organization's intent and direction regarding information security (not specific procedures or setting values).
- Security documents are organized in a hierarchy of “basic policy → control standards (standard) → implementation procedures (procedure),” and the policy sits at the top of this hierarchy.
用語