問25
頻出度★★★
経営戦略上，IT の利活用が不可欠な企業の経営者を対象として，サイバー攻撃から企業を守る観点で経営者が認識すべき原則や取り組むべき項目を記載したものはどれか。
令和元年度 秋期 ITパスポート試験 問25
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 25
Incorrectア
The IT Basic Act (Basic Act on the Formation of an Advanced Information and Telecommunications Network Society) is a law that sets out the basic policy of national measures concerning the formation of an advanced information and telecommunications network society. It does not describe cyber attack countermeasures or action items aimed at management, so it is incorrect.
Incorrectイ
The IT Service Continuity Guidelines summarize the business continuity (BCP/IT-BCP) perspective for keeping IT services running and recovering them during disasters or failures. Their main focus is not principles for management to defend against cyber attacks, so they are incorrect.
Incorrectウ
The Basic Act on Cybersecurity is a law that establishes the basic principles of Japan's cybersecurity measures, the responsibilities of the national and local governments and others, and the setup of a strategy headquarters. It is not a guideline that practically presents, for the management of individual companies, the principles to recognize and the items to address, so it is incorrect.
- エ
正解 The correct answer is エ, the Cybersecurity Management Guidelines. This is a document formulated by the Ministry of Economy, Trade and Industry (METI) and IPA (Information-technology Promotion Agency). It targets the management of companies for which the use of IT is essential to their management strategy. From the perspective of protecting a company from cyber attacks, it specifically describes the three principles that management should recognize and the ten important items that management should instruct responsible executives (such as the CISO) to carry out. Because it meets all of the requirements in the question — targeting management, protecting the company from cyber attacks, and describing the principles to recognize and the items to address — エ is correct.
ここがポイント
- The Cybersecurity Management Guidelines (METI and IPA) are a document that presents, for management, the three principles to recognize and the ten important items.
- Distinguish the different roles: a “Basic Act” is a law that sets out the basic principles and framework of national measures, whereas a “Guideline” describes the items that management should address in practice.
用語