Shared Factory Network: Who Owns Security Traffic and Troubleshooting?

A shared factory network needs an agreed responsibility boundary: factory IT owns the switches and network changes it administers, while the security contractor owns camera and recorder configuration within its contracted scope. The owner should appoint one incident coordinator to bring those parties together. Put capacity approval, permitted traffic and change authority into the proposal. A camera supplier cannot guarantee the operation of infrastructure it cannot inspect, administer or change.

Illustrative project scenario: The security contractor uses switches maintained by the factory IT team. Assume the CASE01 new CNC factory arrangement: 32 ordinary security cameras recording authorised material transfers and access, with four eight-camera access groups feeding one local recorder. These are planning assumptions, not a completed installation. The immediate decision is whether IT will allocate sufficient ports, PoE output and permitted network paths to preserve that recording task.

Start with a drawing that identifies camera ports, access switches, recorder interfaces and authorised viewing clients. Mark who may change each element and who approves an interruption. Treat production-control connections separately. NIST SP 800-82 Rev.3 provides an OT-security reference for considering operational constraints and separation; it does not turn a CCTV VLAN number into a complete access policy.

Agree a diagnostic sequence before the first missing-picture incident. The security contractor checks camera power state, device identity, stream settings and recording status. IT checks the associated switch port, PoE allocation, link errors and permitted path. Both parties use the same camera tag and incident timestamp. This prevents a recorder error from being treated automatically as a network failure, or an unavailable network path from becoming an unsupported camera replacement.

For example, if one camera disappears while seven cameras on the same access group remain available, investigate that camera's port, cable and configuration first. If all eight disappear together, examine the shared switch, uplink and supply. These observations narrow the investigation; they do not prove a cause. A local live picture with missing recorded footage calls for a recorder-side check rather than an immediate backbone change.

Where retained devices come from different brands, separate connectivity from workflow compatibility. ONVIF Profiles concern device and client functions with applicable firmware. A working live stream does not establish event search, audio or every export function. Record the exact tested operation and version so that network troubleshooting is not asked to resolve an unsupported application interface.

The handover should include a per-node switch/power schedule and a permitted traffic matrix. For this illustrative arrangement, identify N1-SW1 through N1-SW4, their assigned camera tags, supply circuits and recorder destination. Each traffic entry should name the source group, destination, required service, approving party and verification method. Do not publish passwords or detailed management access in a general equipment schedule.

Assign the cameras and recorder as supplied equipment under the security contractor's configuration responsibility. Assign the shared switches as retained equipment under factory IT. The local installer owns cable installation and test records within its agreed scope; the electrical contractor owns the approved mains and UPS connections. The project manager coordinates escalation when evidence crosses those boundaries.

The incident record should contain affected tags, time, operational impact, observations and the next authorised action. IT receives a request to investigate a defined port or path, rather than a general claim that the network is unreliable. The security contractor receives recorder and stream evidence. Keep incident coordination separate from authority to change production infrastructure, particularly during active shifts.

Option A retains factory-managed switches and delivers local recording with authorised retrieval. Option B retains that outcome and adds a separately defined management or integration task. Classify every row as supplied, retained, installer-provided or optional, with one accountable owner per interface. An unfilled quotation row is an unresolved scope item, not evidence that it is free.

The decisive difference is the additional service dependency in Option B. An integration server can create another network path, account set and protected load to maintain. Approve it when a named operational task requires it, such as a defined cross-system review workflow. Adding equipment without assigning support ownership makes the shared-network fault boundary harder to manage.

Use CASE01 to anchor the retained infrastructure discussion. Assumed recorder payload is 32 × 4 Mbps = 128 Mbps; an eight-camera group contributes 8 × 4 Mbps = 32 Mbps before overhead. With assumed 12 W device demand, 90% cable delivery and an 80% PSE budget utilisation target, each group requires 8 × 12 W / 0.90 = 106.6667 W PSE output and 106.6667 W / 0.80 = 133.3333 W budget. These are illustrative requirements, not camera measurements or proof that an existing switch qualifies.

Prefer Option A when factory IT accepts the allocation and change process, the retained switches meet the required port and power budgets, and authorised local retrieval satisfies the owner. Shared infrastructure then remains a deliberate project interface. If IT cannot reserve resources or permit the necessary paths, consider dedicated CCTV access infrastructure with an approved connection to viewing clients.

Product selection supports this decision but cannot replace it. The NexPro-NVR4449-4K lists 320 Mbps input, four SATA bays supporting up to 18 TB per drive and dual Gigabit LAN. Its summary distinguishes 49×5MP from 9×4K modes. The illustrative 128 Mbps recording payload must still be checked against actual stream modes and concurrent operations. Neither channel count nor dual LAN establishes RAID, automatic failover or an approved separation architecture.

For a relevant ordinary-area camera reference, the NexPro-BL2812M55-5MP-DIC-AI specification lists 2880×1620 output within its 5MP family and a 2.8–12 mm motorized lens. Its maximum power is not supplied here. Obtain that input before approving retained PoE capacity. Compare another supplier against the same observation tasks, interfaces and support scope, with actual quotations for any cost conclusion.

Before ordering, freeze the camera-to-port map, recorder destination and access approvals as a coordinated revision. Keep the hardware schedule and traffic matrix together. If IT later moves a camera group to another switch, review its PoE allocation, uplink path and protected supply before accepting the change. A port reassignment can alter several dependencies even when the camera model stays unchanged.

Acceptance should demonstrate the contracted workflows: local recording, authorised playback and export, and an agreed response to a disabled path or lost supply. Arrange disruptive checks through the owner's change process. Save the test conditions and results against the affected tags so that later support can distinguish the accepted configuration from subsequent alterations.

NexPro-Link's BOQ and tender support can help align model references, technical submittals and quotation boundaries. Factory project supply can coordinate relevant equipment and project preparation. The retained IT network, local installation and final access approval remain explicit project responsibilities. Deliver the interface record with the equipment documents so the operational team knows who to contact after handover.

Can the security contractor receive read-only switch access? That can support diagnosis if factory IT approves it. Define the permitted information and account lifecycle, and confirm whether port and PoE status are visible. Read-only access does not authorise changes or transfer responsibility for switch operation.

Who should handle intermittent failures outside normal support hours? The contract should name an incident coordinator and each party's escalation coverage. Specify what the onsite team may check safely and what evidence it should preserve. Do not assume an equipment warranty includes out-of-hours network investigation.

Does a dedicated CCTV network remove all shared responsibilities? No. Approved viewing access, upstream services, electrical supplies and maintenance access can remain shared. Dedicated switches simplify some boundaries, but their connections and support owners still need documentation.

Send your camera groups and maximum PD demand, marked link paths, retained switch details, and IT/OT access constraints to info@nexpro-link.com. NexPro-Link can discuss the equipment schedule and interface documentation needed for a comparable quotation.