IPA IP 2023 Question 94

A statement of the organization's intention and direction for information security — the information security policy is the top-level document of an ISMS.

In an ISMS (ISO/IEC 27001), top management establishes the information security policy. It states what the organization intends for information security and which way it is heading, gives a framework for setting information security objectives, commits to meeting the requirements and to continual improvement, and is communicated within the organization. Detailed standards and procedures are written under it to put it into practice.

Answer (d)

Why not others:

• •(a) — the setting values of particular security products are technical standards at the lowest level, not the policy
• •(b) — procedures for handling personal information in certain departments are detailed procedures that sit under the policy
• •(c) — an agreement with a business partner on the information exchanged and how to protect it is a contract, such as a non-disclosure agreement, not the organization's own policy

Key rule: The information security policy is top management's statement of intention and direction for the whole organization; product settings, departmental procedures and agreements with partners sit below it or outside it.

Security · AI-written, may contain errors