IPA IP 2025 Question 84
A question IPA Japan published in 令和7年度 ITパスポート試験 公開問題 問84, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate description concerning the information security policy in ISMS?
Explanation
It must include a commitment to continual improvement of the ISMS — security is not done once, so top management's policy commits the organization to keep improving.
The information security policy is top management's statement of the organization's intentions and direction for information security (ISO/IEC 27001, JIS Q 27001). It sets the framework for security objectives, commits to meeting the applicable requirements, and commits to continually improving the ISMS. It is established by top management for the whole scope of the ISMS, communicated within the organization, and made available to interested parties as appropriate.
Answer (b)
Why not others:
- •(a) — the basic policy states intentions, not secrets; it is communicated to everyone concerned and is often published, including to customers and business partners
- •(c) — the policy covers the whole organization in the ISMS scope; departments may have their own detailed rules and procedures under it, but not separate policies instead of it
- •(d) — the policy is top-down: top management establishes and approves it, not the manager of each workplace
Key rule: An information security policy is set by top management for the whole ISMS scope, communicated widely, and commits to continual improvement.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.