問84
頻出度★★★
ISMS の情報セキュリティリスク対応における, 人的資源に関するセキュリティ管理策の記述として, 適切でないものはどれか。
令和2年度 ITパスポート試験 問84
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 84
Incorrectア
Carrying out background checks such as work history on all candidates for employment in accordance with relevant laws, regulations, and ethics is an appropriate human-resource security control before employment (at the time of hiring), and is a correct description. Hence it is not the “NOT appropriate” one.
Incorrectイ
Establishing a formal disciplinary procedure in advance for employees who have committed an information security violation and making it known is an appropriate control for deterrence and fair punishment, and is a correct description. Hence it is not the “NOT appropriate” one.
- ウ
正解 The correct answer is ウ. In an ISMS, applying information security in accordance with the organization’s established policies and procedures must be required not only of the company’s own employees but also of the other companies to which work is outsourced (contractors and third parties). Because outsourcing extends the handling of information to the outside, if management is cut off there, a hole opens in the security of the entire organization. Choice ウ states that this “is not required of the outsourced companies”, excluding contractors from the scope of management, which runs counter to this principle. Therefore, the description of a human-resource security control that is NOT appropriate is ウ.
Incorrectエ
Defining information security responsibilities and obligations that remain valid after departure (such as confidentiality obligations), communicating them to departing employees, and having them comply even after leaving is an appropriate control to prevent information leakage after the end of employment, and is a correct description. Hence it is not the “NOT appropriate” one.
ここがポイント
- Human-resource security in an ISMS covers the whole period: before hiring (background checks), during employment (making the disciplinary procedure known), and after the end of employment (responsibilities and obligations that remain valid after departure).
- Information security requirements must extend not only to the company’s own employees but also to outsourcing contractors and third parties; excluding contractors from the scope of management is wrong.
用語