I recently had an audit looking at our ATMs, including their security. We have two ATMs that are not on credit union property and I issued a finding because neither of these ATMs are equipped with cameras. Management disagreed with the finding because a) it would be difficult to establish the network access needed to operate the cameras inside of these ATMs that are not on credit union property and b) the facilities that house these ATMs would share their security camera footage with us if we needed it (both buildings are SEG groups of the credit union so there is a relationship).
Does anyone know of any requirements, standards or best practices for ATM security that would clarify whether or not we are okay without having our own cameras covering these ATMs? Thanks!
