問94
頻出度★★★
企業において情報セキュリティポリシー策定で行う作業のうち, 次の作業の実施順序として, 適切なものはどれか。 a 策定する責任者や担当者を決定する。 b 情報セキュリティ対策の基本方針を策定する。 c 保有する情報資産を洗い出し, 分類する。 d リスクを分析する。
令和6年度 ITパスポート試験 問94
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 94
- ア
正解 Establishing an information security policy proceeds in the order: build the organization, set the basic policy, grasp the assets, then analyze risks. First, decide the responsible person and the staff in charge of driving the establishment (a), and under that organization establish the basic policy for information security measures (b). Once the policy is set, identify and classify the held information assets that must be protected (c), then analyze the risks of what threats and vulnerabilities exist against those assets (d). Risks cannot be analyzed unless the assets are grasped, so the order must always be c then d. Therefore the order is a then b then c then d, and the correct answer is ア.
Incorrectイ
The order a then b then d then c. It places risk analysis (d) before identifying and classifying the assets (c), but risks cannot be analyzed while it is not yet decided what to protect. The correct way is to identify and classify the assets first and then analyze risks (c then d); this ordering is reversed.
Incorrectウ
The order b then a then c then d. It places establishing the basic policy (b) before deciding the responsible person and staff in charge (a), but the policy should first have the organization that carries out the establishment, namely the responsible person and staff, decided, and then that organization establishes it. The correct order is a then b; the beginning is reversed.
Incorrectエ
The order b then a then d then c. The leading a and b are reversed, placing policy establishment before building the organization, and d and c are also reversed, placing risk analysis before asset classification, so it is wrong on two counts.
ここがポイント
- The standard procedure for establishing an information security policy is: decide the responsible person and staff in charge, establish the basic policy, identify and classify the information assets, then analyze risks. First set up the organization, decide the policy, grasp what to protect, and only then assess the risks.
- Risk analysis, which is part of risk assessment, can only be carried out after the information assets to be protected have been identified and classified. The key to distinguishing the answer is the sequence: grasping the assets comes first, risk analysis comes after.
用語