問84
頻出度★★★
ISMS における情報セキュリティ方針に関する記述として, 適切なものはどれか。
令和7年度 ITパスポート試験 問84
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 84
Incorrectア
The information security basic policy is a high-level declaration of how the organization approaches information security; it does not describe specific confidential matters. On the contrary, it should be widely communicated and published to employees and even to related parties such as business partners, so there is no need to limit the scope of communication to within the company.
- イ
正解 An ISMS (Information Security Management System) is a mechanism that keeps running the PDCA cycle and improves in line with changes in threats and the environment. The information security basic policy is its top-level declarative document, and ISO/IEC 27001 also requires it to “include a commitment to the continual improvement of the ISMS.” Therefore, security measures are not finished after being implemented once; the policy must include a commitment to continual improvement, making option イ appropriate.
Incorrectウ
The information security basic policy is established uniformly by top management for the entire organization. If each department defines it separately, the organization loses its overall consistency. Specific measures tailored to a department's characteristics should be adjusted in lower-level standards and procedures; the policy itself does not need to be defined per department.
Incorrectエ
The information security basic policy is formulated and approved top-down, premised on the approval and commitment of top management. The statement that it is premised on a bottom-up approach and approved by the manager of each workplace is incorrect; without the involvement of top management, the policy cannot have practical effect across the entire organization.
ここがポイント
- The information security basic policy is the top-level document established uniformly by top management top-down for the entire organization, and is widely communicated and published to related parties.
- An ISMS is premised on continual improvement based on PDCA, and the policy must include a commitment to improvement (ISO/IEC 27001).
用語