It Auditing: Using Controls to Protect Information Assets [IT AUDITING -OS N/D]

Most data centers employ either CCTV, audio surveillance systems, or a combination of the two. These systems typically feed into a guard station, where they are monitored by security personnel and recorded on either tape or a digital storage system.

23 Verify that surveillance systems are designed and operating properly.

Surveillance cameras are a detective control as well as a deterrent for would-be thieves. The absence of surveillance systems would increase the risk of theft and other criminal activities.

How

When auditing a data center, the auditor should review camera quality and placement as well as tape rotation or mass-storage archival schedules. This can be done through a combination of document review and observation. The data center security manager should be able to provide this information.