問85
頻出度★★★
情報セキュリティポリシを, 基本方針, 対策基準, 実施手順の三つの文書で構成したとき, これらに関する説明のうち, 適切なものはどれか。
令和4年度 ITパスポート試験 問85
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 85
- ア
正解 An information security policy is structured in three layers — the basic policy, the standards, and the implementation procedures — where each higher-level document is the basis for the lower-level ones. The topmost basic policy is a document that declares top management’s (the executive level’s) intent and direction, stating why and for what purpose the organization addresses information security; based on it, the standards (the rules to be followed) and the implementation procedures (the concrete methods) are then defined. ア correctly describes the role of the basic policy, so it is appropriate.
Incorrectイ
The implementation procedures are the lowest-level manual that concretely describes how the rules set out in the standards are to be carried out on the ground; they are not a record of the work done to create the basic policy or the standards. Calling them a record of the work for producing higher-level documents misidentifies the document’s role.
Incorrectウ
The standards are a document that defines the concrete rules and compliance items to be observed in order to realize the basic policy; they do not specify the format or criteria of the documents used to formulate the policy. Describing them as the criteria for creating documents does not match what the standards actually contain.
Incorrectエ
In the three-layer structure, the lower the document, the more concrete and detailed its description becomes; the implementation procedures are more detailed than the standards. Therefore, saying that the standards describe things in more detail than the implementation procedures reverses the order of detail and is incorrect.
ここがポイント
- An information security policy has a three-layer structure — basic policy (a statement of top management’s intent) → standards (the rules to be followed) → implementation procedures (the concrete steps) — where the higher layers are more abstract and the lower layers more concrete.
- The basic policy is the topmost document, established by the executive level, and serves as the basis for defining the standards and the implementation procedures.
用語