問94
頻出度★★★
ISMS における情報セキュリティ方針に関する記述として, 適切なものはどれか。
令和5年度 ITパスポート試験 問94
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 94
Incorrectア
Specifying setting values for each security product is a concrete implementation rule that belongs to the lower-level ‘control standards’ or technical standards and setup procedures; it is not the policy itself that shows the organization’s intent and direction.
Incorrectイ
Prescribing personal-information handling procedures for a specific department is at the level of ‘implementation procedures (procedure manuals)’ that define on-site work, and its scope is moreover limited to personal information. It differs from the Information Security Basic Policy, which sets the direction for the whole organization, in both hierarchy and scope.
Incorrectウ
An agreement reached between two companies, your own company and a business partner, on the scope of information assets and how to protect them corresponds to a non-disclosure agreement (NDA) or an arrangement/contract with the partner. It is a different thing from the Information Security Basic Policy that the organization shows internally.
- エ
正解 The information security policy (Information Security Basic Policy) sits at the top of the policy hierarchy in an ISMS. It is a declaration in which top management shows, both inside and outside the organization, its intent of ‘how the organization addresses information security’, and gives direction to the whole organization. Its core point is that it expresses the organization’s stance and basic policy, not concrete setting values or procedures. Therefore, choice エ, which describes it as ‘a document that indicates the organization’s intent regarding information security and sets its direction’, is appropriate.
ここがポイント
- The Information Security Basic Policy stands at the top of the ISMS policy hierarchy (policy → control standards → implementation procedures); it is a declaration in which top management shows the organization’s intent and direction.
- The question tests whether you can distinguish concrete, lower-level documents such as setting values, procedures, and contracts from the ‘policy’ that shows the stance of the whole organization.
用語