IPA IP 2021 Question 96

It is set in view of the company's business, organization and information assets — an information security policy is the organization's own stance, fitted to its circumstances.

The policy states what the organization protects and how it approaches information security. Because businesses, structures and assets differ, a policy copied from another company does not fit; it is drawn up from the company's own situation, approved by top management and made known to everyone concerned. Detailed standards and procedures are then written under it.

Answer (d)

Why not others:

• •(a) — the policy is reviewed and revised as threats, the business or the environment change (the PDCA cycle of an ISMS), not frozen
• •(b) — the policy is not a vision of an ideal; it lays down the concrete principles and rules the organization actually follows
• •(c) — the basic policy is made known to employees and, as a statement of the company's stance, usually published to customers and partners; it is the detailed procedures that are kept internal

Key rule: An information security policy is fitted to the organization, made known to everyone concerned (the basic policy often published) and reviewed regularly.

Security · AI-written, may contain errors