Factory IT Room CCTV: Keep Cameras off the Production-Control Network

Before a service visit, list approved temporary connections, their owners and removal checks. After work, compare the physical patching and permitted traffic with the issued baseline. Refer an unexplained bridge or second-port connection to the network owners before use; successful video does not authorize a new production-network path.

Factory IT room CCTV should connect to an approved security domain with explicitly permitted traffic. Physical proximity to production equipment is not a reason to connect a camera to its control network. Do not use an unmanaged bridge or a dual-port device as an undocumented shortcut between enterprise IT, CCTV and production systems.

Illustrative project scenario: A cabinet room serves enterprise IT and production systems with differing access owners. Assume the security task is to record entry and cabinet-aisle movement while enterprise IT and production teams retain their own network authority. The proposed camera and recorder connections belong to a separately approved security path; shared room space does not imply shared administration.

Mark both boundaries on the design. The physical drawing identifies doors, cabinets, camera views and cable routes. The logical drawing identifies camera access, recording, operator viewing and management paths. Assign an owner to each connection before the quantity surveyor prices switches, links and configuration. NIST SP 800-82 Rev.3 provides an OT-security reference for considering operational constraints and network separation.

Identify who configures cameras, recorders and network infrastructure. A security reviewer may need playback without permission to change camera networking; the network team may manage switching without reviewing recordings. Document the required roles and verify the exact equipment can support the accepted arrangement. Avoid assigning a shared general administrator account to every contractor.

For support access, specify the approved entry point, authorizer and change record. Keep remote access optional until the owner approves its method and operational need. A request for factory technical support does not imply permanent remote connectivity. Where the owner already provides a controlled maintenance path, show it as retained infrastructure and identify any configuration work still needed.

The interface schedule should describe source, destination, purpose and responsible owner for each permitted connection. Include time synchronization and other supporting services only where the selected design needs them. This provides a quotation basis for configuration and verification, and exposes an unpriced dependency before equipment is delivered to the room.

The baseline data path is camera to approved access switch to local recorder. Operator viewing is a separate branch. Loss of that remote branch should not require a deliberate reduction in the locally recorded main stream. Confirm the proposed topology and equipment behavior through a test, particularly where retained infrastructure supplies authentication or supporting services.

CASE08 illustrates four independent 32-camera nodes with local recording and authorized viewing over shared fibre. The total 512 Mbps assumed input is the sum of four 128 Mbps nodes, not a payload that automatically crosses every backbone link. A camera in the shared cabinet room should be assigned to the correct node and footage owner.

NexPro-NVR4449-4K is a recorder reference with 320 Mbps input, four SATA bays and dual Gigabit LAN. Its published summary distinguishes 49×5MP and 9×4K modes. Those fields do not establish routing, firewall behavior, RAID or simultaneous decoding. Any use of its second interface needs an approved configuration; the connector itself is not a network-separation control.

The illustrative recording input is 32 local main streams at 4 Mbps each: recorder_Mbps = 32 × 4 = 128 Mbps. Both viewing options retain that recording input. Sixteen cameras are viewed concurrently. Option A assumes 0.5 Mbps per overview stream, producing 16 × 0.5 = 8 Mbps; Option B uses 4 Mbps per detail stream, producing 16 × 4 = 64 Mbps.

The decisive difference is the viewing task and its payload. An approved overview can reduce the remote viewing demand while preserving the local main-stream recording. It may be unsuitable when the operator must inspect detail across every window. Confirm supported stream selection and client behavior on the exact system; the calculation does not establish universal substream compatibility or WAN performance.

Add viewing to recording demand only on a physical interface where both actually travel, and assess traffic by direction. Include simultaneous playback, export, protocol overhead and unrelated shared-link traffic where present. A central viewing station pulling from multiple building recorders needs its own aggregate calculation. Copying 128 Mbps onto every cable obscures the real bottleneck.

Use the lower-bandwidth overview when it satisfies the approved operator task, with detail retrieval through a separately verified workflow. Select the higher-detail option when the task requires it and the permitted path has sufficient resources. In either case, retain the security-domain boundary. Limited link capacity is a reason to review the task or network design, not to bridge into production controls.

The quantity surveyor should include security switches, approved boundary equipment, uplinks, optics, configuration and testing in the comparison. Existing owner equipment may remain, but its ports, traffic policy and support responsibility need confirmation. Unknown configuration effort is not a free inclusion. Compare competing camera or platform packages against the same administration and recording requirements.

Keep the power drawing separate from the traffic drawing. Protect the actual camera-power switch, recorder and required link equipment at each local AC node. Complete switch AC demand already includes its PoE load. CASE08’s local-node pattern does not mean a central UPS protects remote buildings, and a general UPS quotation should not silently add production-control equipment to its load list.

Prepare an interface schedule and complete shared-equipment allocation that identifies supplied CCTV hardware, retained owner network services, installer-provided configuration and optional remote viewing. Each camera needs a project tag, recorder assignment, cable endpoint and approved network connection. The production network owner should review the boundary drawing independently of camera selection.

NexPro-Link can discuss recorder matching, relevant technical documents, BOQ preparation and project-labelled supply. Exact camera modes, firmware identity and client requirements should accompany the equipment list. Local network policy, boundary implementation and production-system approval remain with the appointed teams; coordinated equipment supply does not provide those approvals.

Acceptance should verify local recording with the remote-viewing path unavailable, demonstrate the approved overview or detail selection, and check the prohibited connections remain unavailable under the delivered configuration. Preserve configuration and connection records for replacements. Recalculate the traffic schedule after changes in concurrent viewing, playback demand or building-node allocation.

Is a CCTV VLAN sufficient by itself? A VLAN can be part of the approved design, but its label alone does not prove that traffic restrictions and administration boundaries are enforced. Specify and test the actual permitted paths with the network owner.

Can we keep an existing enterprise viewing platform? Yes, if the exact camera and recorder workflows are verified and the platform’s access path is approved. Include any stream, account and configuration differences in the quotation.

What if the maintenance team asks to use the production switch? Return the request to the production and network owners before connecting equipment. Evaluate an approved security connection and price its resources rather than treating an available physical port as authorization.

Send a redacted room/network boundary drawing, permitted traffic requirements, concurrent viewing demand and retained switch/recorder inventory to info@nexpro-link.com for a coordinated CCTV equipment scope.