問85
頻出度★★★
情報セキュリティポリシを, 基本方針, 対策基準及び実施手順の三つの文書で構成したとき, これらに関する説明のうち, 適切なものはどれか。
平成31年度 春期 ITパスポート試験 問85
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 85
Incorrectア
The hierarchical order is reversed. The basic policy is the top-level document, formulated by management (the top) as the organization’s stance; the standards and the implementation procedures are lower-level documents created on the basis of the basic policy. Therefore the statement that “employees formulate the basic policy in accordance with the standards and implementation procedures prepared by management” is wrong.
Incorrectイ
The basic policy is the top-level document that states the organization’s approach, purpose, and declaration for how it addresses information security; it is not a response manual describing the actions management should take when an incident occurs. It confuses the roles, so it is wrong.
- ウ
正解 An information security policy is organized into three tiers: basic policy → standards → implementation procedures. The implementation procedures, at the lowest tier, are a document that describes in detail the specific ways of proceeding and the work steps, so that the person in charge can actually carry out on site what has been defined in the standards above them. Choice ウ correctly states this role of the implementation procedures, so it is appropriate.
Incorrectエ
The standards are the middle-tier document that defines the specific rules and criteria to be observed in order to realize the basic policy; they are not in a position to prescribe what should be written in the higher basic policy or the lower implementation procedures. It mistakes the roles of the tiers, so it is wrong.
ここがポイント
- The three-tier structure of an information security policy: basic policy (top tier, management’s policy declaration) → standards (middle tier, rules/criteria to be observed) → implementation procedures (lower tier, concrete execution steps). The higher the tier, the more abstract and stable; the lower the tier, the more concrete.
- The role of each document: basic policy = why / what to aim for; standards = what to comply with; implementation procedures = how to carry it out. Lower-level documents are created on the basis of higher-level documents (top-down).
用語