IPA IP 2022 Question 85
A question IPA Japan published in 令和4年度 ITパスポート試験 公開問題 問85, translated into English. ITPEC is based on the same exams.
When an information security policy is composed of three (3) documents, namely, basic policy, standards, and procedures, which of the following is the appropriate explanation concerning these documents?
Explanation
The basic policy states top management’s intention — it sits above the standards and procedures, which are derived from it.
An information security policy is usually built in three layers. The basic policy is the top layer: top management’s declaration of why and how the organization protects information. The standards (measures standards) set the rules each area must follow to realize that policy. The procedures are the concrete steps staff follow in daily work to meet the standards. Each layer is written from the one above it.
Answer (a)
Why not others:
- •(b) — procedures are operating instructions for carrying out the standards, not a record of how the policy documents were drawn up
- •(c) — the standards are rules for security measures, not criteria for how to write policy documents to match ISMS
- •(d) — the standards are more general than the procedures, not more detailed, and they cover measures as a whole, not only what follows an accident
Key rule: Basic policy (management’s intent) → standards (rules to follow) → procedures (concrete steps): detail grows from top to bottom.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.