問93
頻出度★★★
ISMS における情報セキュリティ方針に関する記述として, 適切なものはどれか。
平成30年度 春期 ITパスポート試験 問93
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 93
Incorrectア
The information security policy should be defined in a workable form that takes the company's actual situation (assets, risks, business content) into account. If it describes only an ideal form detached from reality, it cannot be applied to actual operations and becomes a mere formality, so this is inappropriate.
Incorrectイ
The policy takes effect only when it is made known to all employees of the organization (and, as needed, related parties such as business partners) and everyone understands and complies with it. Limiting awareness to information security personnel only goes against the purpose of the policy, so this is inappropriate.
- ウ
正解 In an ISMS (an Information Security Management System based on ISO/IEC 27001), the information security policy is a document that expresses the organization's highest-level intent, and the standard clearly states that the responsibility for establishing and approving it lies with top management. Only when the policy is backed by top management's commitment can the company-wide budget, structure, and rules operate effectively. Therefore, choice ウ, which says it must be established by top management, is appropriate.
Incorrectエ
If the scope of application covers the entire company, the policy should also be defined as a single unified one for the whole company. Establishing it separately on a per-department basis loses company-wide consistency and makes unified control impossible, so this is inappropriate.
ここがポイント
- The information security policy is the top-level document of an ISMS; top management is responsible for establishing it and for making it known and maintained across the whole company.
- The policy should be defined in a workable way based on the organization's actual situation and risks, and unified across the whole company according to its scope of application.
用語