Certified Information Systems Auditor (CISA) — Question 181

An IS auditor is conducting a physical security audit of a healthcare facility and finds closed-circuit television (CCTV) systems located in a patient care area. Which of the following is the GREATEST concern?

Answer options

• A. There are no notices indicating recording is in progress.
• B. Cameras are not monitored 24/7.
• C. There are no backups of the videos.
• D. The retention period for video recordings is undefined.

Correct answer: A

Explanation

The greatest concern is that there are no notices indicating recording is in progress, as this could violate patient privacy and consent laws. While the other options present issues such as lack of monitoring, backups, and retention periods, they do not directly address the immediate risk of unauthorized recording without notification.