In reviewing the IT strategic plan, the IS auditor should consider whether it identifies the major IT initiatives that are aligned with the organization's vision, mission, and objectives, and that support the business strategy and priorities12. The major IT initiatives should also be realistic, measurable, and achievable, and should have clear timelines, budgets, and responsibilities34.
References
1: IT Strategy Template for a Successful Strategic Plan | Gartner2 2: IT Strategy Template for a Successful Strategic Plan | Gartner4 3: Conduct a Strategic Plan Review & Assessment - Governance3 4: Time To Conduct A Strategy Review? Here's How To Get Started1

IT governance is a framework that defines the roles, responsibilities, and processes for aligning IT strategy with business strategy. The board of directors of an organization is ultimately accountable for IT governance and has the authority to approve the IT strategy. The board of directors does not need to address technical IT issues, be informed of all IT initiatives, or have an IT strategy committee, as these tasks can be delegated to other stakeholders or committees within the organization.

The greatest concern with finding closed-circuit television (CCTV) systems located in a patient care area is that there are no notices indicating recording is in progress. This is because CCTV systems in healthcare settings can pose a threat to the privacy and confidentiality of patients, staff, and visitors, especially in sensitive areas where personal or medical information may be exposed. According to the government's Surveillance camera code of practice1, CCTV operators must be as transparent as possible in the use of CCTV, and inform people that they are being recorded by using clear and visible signs. The signs should also provide contact details of the CCTV operator and the purpose of the surveillance. By providing notices, CCTV operators can comply with data protection law and respect the rights and expectations of individuals.
Option B is correct because the lack of notices indicating recording is in progress is a clear violation of the Surveillance camera code of practice1, which applies to local authorities and the police, and is encouraged to be adopted by other CCTV operators in England and Wales. The code also applies to Scotland, along with the National Strategy for Public Space CCTV2. The code is intended to be used in conjunction with the guidance provided by the Information Commissioner's Office (ICO)3, which applies across the UK. The ICO states that CCTV operators must inform people that they are being recorded by using prominent signs at the entrance of the CCTV zone and reinforcing this with further signs inside the area.
Option A is incorrect because cameras not being monitored 24/7 is not the greatest concern, as it does not necessarily affect the privacy and confidentiality of individuals. CCTV systems may have different purposes and objectives, such as deterring or monitoring crime, enhancing security, or improving patient care.
Depending on the purpose, CCTV systems may not require constant monitoring, but rather periodic review or analysis. However, CCTV operators should still ensure that they have adequate security measures to protect the CCTV systems from unauthorized access or tampering.
Option C is incorrect because the retention period for video recordings being undefined is not the greatest concern, as it does not directly affect the privacy and confidentiality of individuals. However, CCTV operators should still define and document their retention policy, and ensure that they do not keep video recordings for longer than necessary, unless they are needed for a specific purpose or as evidence. The retention period should be based on a clear and justifiable rationale, and comply with data protection law and industry guidelines.
Option D is incorrect because there being no backups of the videos is not the greatest concern, as it does not affect the privacy and confidentiality of individuals. However, CCTV operators should still consider having backups of their videos, especially if they are needed for a specific purpose or as evidence. Backups can help to prevent data loss or corruption due to system failures, disasters, or malicious attacks. Backups should also be stored securely and encrypted to prevent unauthorized access or disclosure.

This should result in a finding because it violates the best practice of setting rules for groups rather than users. According to one of the web search results1, using group permissions instead of individual permissions can simplify the management and maintenance of ACLs, reduce the risk of human errors, and ensure consistency and compliance. Individual permissions can create conflicts, confusion, and security gaps in the ACLs. Therefore, the IS auditor should report this as a finding and recommend using group permissions instead.