Cameras and access control on your own network

At some point most businesses want cameras, and a lot of them want to stop handing out brass keys too. The security industry is happy to sell you both as a monthly subscription with per-camera fees forever. The alternative, running cameras and door access on your own network, costs more up front, less over time, and leaves you owning your own footage and your own locks. Here is how the pieces fit and where the real decisions are.

PoE cameras: one cable does everything

Skip Wi-Fi cameras for business use. Battery and wireless cameras are fine for a doorbell at home; in a business they mean dead batteries, dropped clips, and footage that saved to someone's personal cloud account. The business-grade answer is PoE: cameras powered over the same Ethernet cable that carries their video, plugged into a PoE switch.

That buys you reliability (no batteries, no wireless interference), clean installs (one Cat6 run per camera, no electrician needed at the camera location), and central power. Put the PoE switch on a UPS and every camera stays up through an outage, which is precisely when you want cameras working.

Camera placement is its own small discipline: cover entrances, points of sale, and loading areas; mount high enough to avoid tampering but low enough to catch faces, since a straight-down view of the top of a head identifies nobody. And in most cases, cameras face doors and public areas, not employees' desks. Check your state's rules on audio recording before enabling microphones; audio consent laws vary and several states are strict about it.

NVR or cloud: where does the footage live?

An NVR, a network video recorder, is a box on your rack with big drives that records every camera continuously. The alternative is cloud recording, where each camera streams to a vendor's servers for a per-camera monthly fee.

The honest comparison:

• Cost: an NVR is a one-time purchase. Cloud fees per camera per month look small until you multiply by 12 cameras and 5 years, at which point the cloud has cost several times the NVR.
• Bandwidth: a dozen cameras streaming to the cloud around the clock eats a serious chunk of your internet upload. Local recording uses none of it.
• Access and resilience: cloud systems make remote viewing effortless and survive the NVR being stolen or burned. A local NVR keeps recording when the internet is down, which cloud cameras generally cannot. The theft risk is real but manageable: lock the NVR in the rack cabinet and, on systems that support it, mirror critical clips offsite.
• Ownership: with local recording the footage is yours. With cloud, your access to your own footage lasts exactly as long as the subscription.

For most small businesses we favor a local NVR, and ecosystems like UniFi Protect or a standalone NVR with ONVIF-compatible cameras make it straightforward, with remote viewing through the controller. Cloud-first systems like Verkada or Rhombus make sense for companies with many sites and nobody local to touch hardware, priced accordingly.

Badges and fobs instead of brass keys

The problem with metal keys is arithmetic: keys get copied and never come back, and when an employee with a key leaves on bad terms, the honest fix is rekeying every lock. Electronic access control replaces the key with a badge, fob, or phone credential, and replaces the locksmith visit with a checkbox.

The parts: a reader at each door, an electric strike or magnetic lock in the frame, and a controller that decides who gets in. Modern small-business systems put the controller on your network and often power everything over PoE, so a door becomes, from a wiring standpoint, another network drop plus lock hardware.

What you get beyond convenience: per-person credentials that deactivate the minute someone leaves, schedules (the cleaning crew's fob works weekday evenings only), and an audit log of who opened which door when. That log is the feature businesses do not know they need until the first time they need it.

One non-negotiable: doors must fail safe for the people inside. Egress hardware and fire code come first, and lock choice (fail-secure strikes versus fail-safe maglocks) has life-safety implications. This is the part of the job where we involve a licensed low-voltage or locksmith professional and pull the right permits, and you should expect the same from anyone you hire.

Why all of it belongs on its own VLAN

Cameras and door controllers are computers, usually cheap ones, sometimes with firmware that stopped getting updates years ago. Compromised cameras are a well-worn path into networks and a favorite recruit for botnets. So the standing rule: surveillance and access control get their own VLAN, walled off from the network your workstations and file server live on.

Concretely, that means the cameras, NVR, and door controllers sit in their own network segment, firewall rules block that segment from reaching your business systems, and ideally the cameras cannot reach the open internet at all except for firmware updates and, if used, their vendor's cloud relay. Your management workstation can reach into the camera VLAN; the cameras cannot reach out. If a camera is ever compromised, the blast radius is other cameras, not your accounting system. We covered the general concept in our VLANs post; this is the textbook use case for it.

Retention: how long to keep footage

Retention is a math problem and a policy problem. The math: recording hours times camera count times bitrate determines drive space. As a rough feel, a dozen cameras at 1080p with continuous recording fit around 30 days on the multi-terabyte drives NVRs typically ship with, and motion-only recording stretches that a lot. Higher resolution or more cameras shrinks it.

The policy: 30 days is a common small-business default, and it is enough for most incidents, which get discovered within days. Some industries and some insurers specify minimums, so check yours. Write the retention period down somewhere official, because "how far back does the footage go" is a question you will eventually be asked by police, a lawyer, or an insurance adjuster, and "we are not sure" is a bad answer. Also decide who may review and export footage, and keep that list short.

How to know it was done right

Every camera and door controller is on the isolated VLAN and cannot browse the internet. The NVR is locked up, on the UPS, and you have tested pulling up footage from two weeks ago. Terminated employees lose door access the same day, and the audit log proves it. Default passwords are gone from every device. And the retention policy is written down, with drive space that actually delivers it.

Owning this stack takes a competent setup and a little maintenance. In exchange, no subscription decides whether you can open your own door or watch your own footage.