問79
頻出度★★★
企業のリスクマネジメントの一環として行われるサイバーセキュリティリスク対策の推進において，経営者に求められる役割として，最も適切なものはどれか。
令和8年度 ITパスポート試験 問79
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 79
Incorrectア
If the formulation and execution of each department's policy is entrusted entirely to the IT department's staff, executives are not involved and company-wide risk control becomes impossible. Security is not merely an IT-department problem but a management issue, and executives must be responsible for policy and resource allocation, so this is inappropriate.
Incorrectイ
Appointing a CISO (Chief Information Security Officer) is itself effective, but it is wrong for executives to withdraw by entrusting execution and decision-making entirely to that person. The guidelines require executives to bear the ultimate responsibility and exercise leadership themselves, so the attitude of appointing someone and offloading everything is inappropriate.
- ウ
正解 The correct answer is ウ. The Cybersecurity Management Guidelines position cybersecurity countermeasures as a management issue and require executives themselves to exercise leadership. Specifically, executives proactively take on examining the implementation policy, allocating management resources such as budget and personnel, checking the implementation status, and grasping and responding to problems. ウ correctly expresses this attitude of executives staying involved as the responsible parties, and is the most appropriate.
Incorrectエ
Receiving advice from an external consultant is fine, but it is wrong to delegate even the authority and responsibility for risk analysis and countermeasure promotion to an outside party. Responsibility for the company's own risks should be borne by executives and is not something that can be entirely offloaded to outsiders, so this is inappropriate.
ここがポイント
- Basic stance of the Cybersecurity Management Guidelines: security countermeasures are not left to the IT department but are a management issue, and executives themselves exercise leadership.
- The executive's role is to examine the implementation policy, allocate budget and personnel, check the implementation status, and respond to problems; responsibility must never be offloaded or delegated to others.
用語