問96
頻出度★★★
情報セキュリティ方針に関する記述として, 適切なものはどれか。
令和3年度 ITパスポート試験 問96
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 96
Incorrectア
An information security policy is not fixed once it has been established; it must be periodically reviewed and improved in response to changes in the business environment, threats, and laws and regulations (continuous improvement through the PDCA cycle). It is wrong to claim that it “must not be changed until operations have stabilized”.
Incorrectイ
A policy should serve as the basis for feasible, concrete efforts, not merely present an unreachable “ideal state”. Effectiveness grounded in the company’s own reality is what matters, so a statement whose purpose is to describe an ideal state does not fit the nature of a policy.
Incorrectウ
The basic policy is a document that declares management’s stance on security to stakeholders inside and outside the company, and it is generally made public (for example, disclosed on the company’s own website). Keeping the whole thing confidential and non-public to outsiders is not appropriate (this confuses it with the fact that the detailed control standards and implementation procedures are managed internally).
- エ
正解 An information security basic policy is not a generic template that applies to every company; it should be formulated to fit the actual situation of the specific organization. Choice エ states that it is “formulated by taking into account the company’s own business activities, the characteristics of the organization, and the features of the information assets it holds”, which is exactly this principle. Because the information assets to be protected and the risks faced differ by industry, scale, and organizational culture, a policy becomes truly effective only when it is grounded in the company’s own circumstances. Therefore エ is appropriate.
ここがポイント
- An information security basic policy is formulated individually, taking into account the company’s own business activities, organizational characteristics, and the actual state of its information assets.
- A policy should be continuously reviewed (PDCA) and, as an expression of management’s stance, is basically made public to the outside; it is not something to be kept secret or fixed.
用語