問84
頻出度★★★
内外に宣言する最上位の情報セキュリティポリシに記載することとして, 最も適切なものはどれか。
令和元年度 秋期 ITパスポート試験 問84
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 84
- ア
正解 An information security policy is generally organized into three tiers: basic policy (top level) → control standards → implementation procedures. The top-level basic policy is a document that the organization declares both internally and externally; it states the management's attitude, purpose, and scope in seriously addressing information security, without going into specific procedures. Therefore, choice ア, «the management's attitude toward addressing information security», is the most appropriate item to describe in the top-level policy.
Incorrectイ
«Specific and detailed procedures for protecting information assets» belong in the implementation procedures (procedure manuals), the lowest of the three tiers, not in the top-level basic policy declared internally and externally. Disclosing detailed procedures would also reveal one's methods to attackers, so it is inappropriate.
Incorrectウ
«The cost spent on security measures» is internal information related to budgeting and operational management, not an item to describe in the top-level policy that declares the organization's attitude. There is also no point in declaring monetary amounts internally and externally.
Incorrectエ
«The specific individual information assets to be protected» are managed in lower-level documents such as the control standards. Enumerating individual assets is not the role of the top-level declaratory document, and disclosing specific asset names externally is also inappropriate from a confidentiality standpoint.
ここがポイント
- The three-tier structure of an information security policy: the top-level «basic policy» is declared internally and externally and states the management's attitude and purpose, while the lower «control standards» and «implementation procedures» define specific rules and steps.
- Distinguishing levels of abstraction: the higher the tier, the more abstract and declaratory it is (attitude and policy); the lower the tier, the more concrete it is (procedures and target assets). Specific procedures, individual assets, and costs are not written at the top level.
用語