Guide to Video Surveillance

Most organizations do not buy a video surveillance system once. They buy some cameras, then add more, then inherit a building that already has a recorder nobody has logged into for two years. This guide is written for the point at which that stops being workable and you need to think about the whole thing: what a system is made of, what it is for, how the parts fit together, and what to decide first.

What it is

A video surveillance system is four things working together, and only one of them is a camera.

• Cameras. The sensors. Resolution, lens choice, low-light performance and physical placement decide what you can actually see, and no amount of software recovers detail a camera never captured.
• A network and power path. On a modern system this is usually structured cabling carrying both data and power to each camera. It is the part that gets underestimated, and the part that is expensive to change later.
• Recording and storage. A recorder on site, a cloud service, or both. How many days of footage you keep is a policy decision before it is a technical one, and it drives more of the cost than the cameras do.
• Software and the people who use it. Video management software for live view, search and export, plus whoever is responsible for reviewing footage, granting access and responding when something happens.

It helps to see where this sits in a wider security program. NIST SP 800-53, the federal control catalog that many private organizations also use as a reference, treats video as one method of monitoring physical access rather than as a category of its own. Control PE-6 requires an organization to monitor physical access to detect and respond to physical security incidents, and its discussion gives the methods: "the employment of guards, video surveillance equipment (i.e., cameras), and sensor devices." Cameras are a means, not the objective.

For a plain definition of the components and the terms, see what video surveillance is.

Why it matters

Three reasons come up repeatedly, and they are worth separating because they lead to different systems.

Evidence after an incident

This is the reason most buyers state first, and it is the one most often disappointed. Footage is useful as evidence only if it was recorded at a resolution that identifies rather than merely detects, was retained long enough to still exist when the incident is reported, and can be exported in a form somebody else will accept. A system that fails any of the three produces video that is worth very little at the moment it is needed.

Safety and deterrence

Workplace violence is a real and measured hazard, not a hypothetical one. The Occupational Safety and Health Administration reports that acts of violence are the third leading cause of fatal occupational injuries in the United States, and that of the 5,283 fatal workplace injuries recorded in 2023, 740 were due to violent acts, of which 458 were homicides. Surveillance is one control among several that organizations apply to that risk, alongside access control, lighting, staffing and procedure. It is worth being honest about the limits: a camera records, and recording changes behavior in some settings and not in others.

Operations

The reason buyers mention last and value most once they have it. Knowing when deliveries actually arrive, where queues form, which door props open every afternoon, and whether a process was followed is often the return that justifies the system, and it is available from footage you were recording anyway.

How it works

End to end, a frame of video takes the same path in almost every system.

1. Capture. The camera converts a scene to a compressed video stream. Field of view and pixel density on the target decide what the frame is good for.
2. Transport. The stream crosses your network. On most installations the same cable also powers the camera, which is why the cabling design constrains what you can install and where.
3. Record. A recorder or a cloud service writes the stream to disk, usually continuously, sometimes on motion or event.
4. Retain. Footage is kept for a defined period and then overwritten. NIST states this as an organizational decision rather than a fixed number: its video surveillance control requires you to "retain video recordings for" a period the organization defines, and to review recordings at a defined frequency.
5. Review and export. Someone searches the archive and produces a clip. This is the step that exposes whether the system was set up well, because it is the first time anyone tests search, time synchronization and export together.

Two things about that list are worth dwelling on. The first is that NIST is explicit that "monitoring the surveillance video is not required" for the control to be satisfied. Recording and reviewing is a legitimate design; staffing a wall of monitors is a different and much more expensive one, and buyers sometimes assume the second is implied by the first.

The second is that every camera on the list is a networked computer. That is not a figure of speech. NIST publishes a baseline of cybersecurity capabilities that an internet of things device should have, covering device identification, device configuration, data protection, logical access to interfaces, software update and cybersecurity state awareness. A camera that cannot be updated, cannot restrict access to its interfaces, and cannot tell you its own state is a device you have installed on your network and cannot manage. The security and risk side of video surveillance goes into what that means in practice.

What to do next

The sequence that works, in the order that saves the most rework:

1. Write down what each camera is for. One sentence per location, naming what you need to be able to see and how long you need to keep it. This single document decides resolution, placement and storage, and its absence is the most common reason a system disappoints.
2. Settle retention and access before hardware. Who may view footage, who may export it, and how long it is kept. These are the questions that carry legal weight, and they are covered in recording, privacy and the law.
3. Check procurement constraints early. If you sell to or receive funding from the federal government, some equipment is prohibited outright, and finding that out after installation is expensive. See the federal procurement rules.
4. Then compare systems. Use the buyer checklist for the questions worth asking, and what drives the cost to understand the quotes you get back.

If you would rather start from your own building than from a specification, LABUSA will walk the site, document what each area needs and tell you what a system for it would involve. Request a free site security assessment, or read more about our video surveillance solutions. Hospitality, where guests sleep on the premises and the coverage line is drawn differently, is covered in video surveillance for hotels and hospitality.

Sources

• National Institute of Standards and Technology, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. Establishes control PE-6 and its discussion naming guards, video surveillance equipment and sensor devices as methods of monitoring physical access, and the video surveillance control requiring recordings to be retained for an organization-defined period, with monitoring of live video explicitly not required. nvlpubs.nist.gov. Accessed 18 August 2026.
• National Institute of Standards and Technology, IR 8259A, IoT Device Cybersecurity Capability Core Baseline. Establishes the six device capabilities quoted here: device identification, device configuration, data protection, logical access to interfaces, software update and cybersecurity state awareness. nvlpubs.nist.gov. Accessed 18 August 2026.
• Occupational Safety and Health Administration, Workplace Violence. Establishes the 2023 figures quoted: 5,283 fatal workplace injuries, 740 due to violent acts and 458 homicides, and that acts of violence are the third leading cause of fatal occupational injuries. osha.gov. Accessed 18 August 2026.
• General Services Administration, FAR 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. Establishes that specific video surveillance equipment is prohibited in federal contracting, the constraint referred to above. acquisition.gov. Accessed 18 August 2026.