Certified Information Systems Auditor (CISA) — Question 1274

During an audit of an access control system, an IS auditor finds that RFID card readers are not connected via the network to a central server. Which of the following is the GREATEST risk associated with this finding?

Answer options

• A. Lost or stolen cards cannot be disabled immediately.
• B. Card reader firmware updates cannot be rolled out automatically.
• C. The system is not easily scalable to accommodate a new device.
• D. Incidents cannot be investigated without a centralized log file.

Correct answer: A

Explanation

The primary risk of not having RFID card readers connected to a central server is that lost or stolen cards cannot be disabled immediately, leaving the system vulnerable to unauthorized access. While the other options present valid concerns, they do not pose an immediate security threat like the inability to quickly disable compromised cards does.