The 20-Minute CCTV Self-Audit for Factory Owners: Check What You Have Before You Buy
Before you take a single quote, spend 20 minutes finding out whether your existing CCTV records, how many days it keeps, whether its clock is right, which models are on your walls, and whether the cameras can feed anything beyond a monitor. Often the answer to "what should I buy?" is "fix two settings and add one disk", and only checking tells you.
By the Mama Editorial Team. This is written for the owner or director, not the installer. No settings menus: every check is visible from the recorder screen or the floor, and every result points to a next step.
Key takeaways
- Live view is not recording. The only proof is playback: pull up yesterday at 3 a.m. and at a shift change, on every camera.
- Retention is a number of days, not a disk size. Scroll back to the oldest footage the recorder still holds and write the date down.
- A wrong clock makes good footage useless in a dispute or an accident inquiry. Compare the on-screen time with your phone.
- List every model, then check certification in a finder, not on a sticker.
- Ask whether the cameras give an RTSP/ONVIF stream. If yes, most of what you own can be reused.
- Know who holds the admin password. If the answer is "the installer", you do not fully control your own system.
Why audit before you buy
Most CCTV purchases start with a quote from someone paid to sell hardware. A self-audit changes the conversation from "what do you recommend?" to "here is what I need, quote for this", and stops you replacing things that work. The 2026 certification rule governs sales, not what you already run (more in minutes 10–14).
To sign off a new installation, use our commissioning checklist instead. Bring the recorder login, your phone and a sheet with columns for camera, location, records yes/no, oldest footage, model and what it should see.
The audit, minute by minute
Minutes 0–5: is it actually recording
Open playback, not live view. Pick yesterday, and check two moments on every channel: 3 a.m. (when nothing moves) and the time of a shift change (when a lot moves).
- Footage at both times. If a channel has footage at the shift change but nothing at 3 a.m., it is probably set to record only on motion. That is a choice, but quiet hours then leave no trace.
- Black or grey tiles in playback where live view shows a picture. The camera is connected, but its schedule is off or the disk is not writing.
- A disk warning icon or alarm on the recorder screen.
Pass: every channel has footage at both times. Fail: any channel without footage, or a disk warning. This is the most urgent finding of the audit.
Minutes 5–8: how many days does it really keep
In playback, go back day by day on two or three channels until you hit the first day with no footage. That date is your real retention. Write it down.
Compare it with what you need. No Indian law sets one number for every factory; some state conditions and buyer audits specify days, so confirm what applies to you. MeitY's own advice to government buyers frames it the same way: storage should be specified "in terms of storage duration (number of Days) based on operational requirements rather than storage capacity" (MeitY advisory OM, 11 March 2024, para xv, copy hosted by AMU).
Pass: real retention is at least your target. Fail: fewer days. Retention shrinks quietly when someone raises resolution or adds cameras. Our storage calculator turns cameras, bitrate and days into terabytes.
Minutes 8–10: is the clock right
Compare the time stamp on the recorder and on a few camera tiles with your phone.
Pass: within a minute, on every tile, and the date is right. Fail: minutes off, or cameras disagreeing with each other. When you match a stoppage to the shift register or a gate entry to a weighbridge slip, a 14-minute drift turns a clear record into an argument.
The fix is a setting: point the recorder at a network time server. CSIR-National Physical Laboratory runs public time servers at "time.nplindia.in OR time.nplindia.org" (NPL). CERT-In's directions of 28 April 2022 require body corporates, among others, to sync ICT system clocks to NIC or NPL time servers or ones traceable to them (as summarised by Khaitan & Co).
Minutes 10–14: what is on your walls
Photograph each camera's label, or the model on the recorder's device information screen. You need the full model number with suffix, because certification is granted model by model. Later, look each model up in our certified CCTV finder and, if you have a certificate number from the vendor, verify it in the certificate checker.
Why it matters: MeitY says "no sale of any CCTV cameras, which do not conform to ERs" (its security Essential Requirements) shall be allowed from 1 April 2026 (MeitY Office Memorandum W-18/26/2025-IPHW, 16 January 2026). The ER applies to IP cameras; BIS, citing MeitY, says analogue cameras need only the IS 13252 test report and no ER test (BIS circular, 1 April 2025); government tenders under S.O. 1119(E) word the ER to include analogue cameras. So note which units are IP (ER vs BIS vs PPO explainer). The rule shapes what you buy next; nothing requires a private factory to remove working installed cameras.
Pass: you have a full model list. Fail: cameras with no readable label and no model on the recorder. Those are the ones to ask the vendor about first.
Minutes 14–16: can the cameras talk to anything else
Ask your maintainer:
- Does the recorder or each camera give an RTSP stream (a standard video feed other software can open)?
- Is ONVIF available, and which profile? Profile S covers basic "video streaming and configuration", but ONVIF is retiring it: new conformance submissions end 31 March 2027 (ONVIF Profile S). For new purchases, ask for Profile T (profiles explained).
If they cannot answer, check your model list against the retrofit guide; some analogue DVRs expose a stream per channel too.
Pass: RTSP or ONVIF confirmed. Fail: "we don't know" or "it only works with our app". A closed system ties every upgrade to one vendor.
Minutes 16–19: what can the cameras not see
Stand at your two or three critical points (bottleneck press, packing line, dispatch gate, weighbridge) and ask: which camera covers this, and could I tell from footage whether it was running?
Common findings: the machine is behind a pillar or WIP stack; the gate camera sees trucks, not material; a bright doorway turns the machine into a silhouette.
Pass: each critical point is covered from an angle where you can tell running from stopped. Fail: any critical point not visible. Your list of what each point should show is your real requirement, more useful to a vendor than a camera count.
Keep this to machines, gates and flows. Cameras do not belong in washrooms, changing rooms or rest areas, and workers should know what is recorded and why: see the worker CCTV notice under DPDP.
Minutes 19–20: who holds the keys
Who knows the recorder's admin password? Is it still the default? If the installer disappeared tomorrow, could you get in?
MeitY's advisory says to "change default passwords immediately upon installation and use strong, unique passwords for all cameras, recorders, and access points" and to give different access levels by role (MeitY advisory, paras vii and xiv). It is addressed to government departments, but the logic holds. Under the DPDP Act a data fiduciary must take "reasonable security safeguards to prevent personal data breach", and failing that duty carries a penalty that "may extend to two hundred and fifty crore rupees" (DPDP Act, 2023, s.8(5) and Schedule item 1). That duty is enforceable from 14 May 2027 under the DPDP Rules, 2025 (Shardul Amarchand Mangaldas).
Pass: the owner's side holds the admin password, it is not a default, and the installer has a separate login. Fail: default password, or only the installer knows it.
The scorecard: what each result means
| Check | Pass | Fail means | Next step |
|---|---|---|---|
| Recording | Footage at 3 a.m. and at shift change, all channels | Paying for cameras that leave no record | Fix today: schedule or disk. Call the maintainer |
| Retention | Days ≥ your target | Disk too small for current settings | Add disk or lower bitrate on low-value cameras |
| Clock | Within 1 minute everywhere | Footage hard to use in disputes | Set network time on the recorder (setting, not purchase) |
| Models | Full list with suffixes | Unknown hardware, unknown support | Look up in finder; ask vendor about unlabelled units |
| RTSP/ONVIF | Confirmed | Locked to one vendor's app | Ask before buying anything that must read the cameras |
| Coverage | Critical points visible | Money leaks you cannot see | Re-aim or add a few cameras at named points |
| Passwords | Owner holds admin, no defaults | You don't fully control your system | Change admin, give installer a separate login |
Four or more passes: the system is probably worth building on. Fix recording and passwords before buying anything.
A worked ₹ example
All numbers below are assumptions for illustration, not measurements from any plant. Assume a 16-camera, 2 MP plant recording H.265 continuously at about 2 Mbps per camera, with one 4 TB disk, and a target of 30 days.
The storage arithmetic: 1 Mbps of continuous video is 10.8 GB per day (the formula is in the storage calculator linked above), so 2 Mbps is about 21.6 GB per camera per day, or about 346 GB per day for 16 cameras.
| Audit finding (assumed) | What it means | Fix | Indicative cost |
|---|---|---|---|
| 3 channels live but not recording | 3 of 16 cameras leave no record | Recording schedule corrected | ₹0 if a setting; a maintenance visit if not |
| Real retention 11 days (4,000 GB ÷ 346 GB/day ≈ 11.6) | Target is 30 days ≈ 10.4 TB | Add one 8 TB surveillance disk, if the recorder has a free bay | Single listing, not a market price: one seller on IndiaMART shows ₹22,000 per 8 TB WD surveillance drive (tax not stated); get a current quote |
| Clock 14 minutes slow | Footage disputes | Network time set on recorder | ₹0 |
| 2 bottleneck machines not visible | Idle time on them can't be explained | Re-aim 2 cameras or add 2 | Assume ₹0 to re-aim; new cameras per your quote |
| Default admin password | Security gap (DPDP duty from 14 May 2027) | Change, create installer login | ₹0 |
What does the blind spot cost? Assume each bottleneck machine is worth ₹1,500 per hour to you in contribution and stands idle 45 minutes a day with nobody able to say why. That is 2 × 0.75 × ₹1,500 = ₹2,250 a day, or about ₹58,500 over 26 working days. Your real number may differ, but in this example the money is in what the cameras can't see, and most other fixes are free.
What this audit can't tell you
- Night image quality. Repeat the playback test on night-shift footage.
- Network exposure. Whether your recorder is reachable from the internet needs a proper check by your IT person, not a glance at the recorder screen.
- Disk health. A disk that records today can fail next month.
- Certification. A label photo is a start; the certificate lookup is the proof.
- Why a machine stopped. Footage shows a machine stood idle, not always why: material, breakdown or a planned wait. You still need the register and the supervisor.
Where Mama fits
Once your cameras pass, they can do more than feed a monitor nobody watches. Mama reads existing cameras (or a few added where the audit found gaps) and each morning gives the owner a short plain-language note on where hours leaked yesterday: idle machines, late starts, waiting material. It watches machines and flows and counts people only in aggregate, with no names and no operator ranking. Mama can draw a camera plan for the gaps your audit found. Leave an email or phone in the form below.
FAQ
How do I know my CCTV is recording and not just showing live video? Use playback, not live view: check yesterday at 3 a.m. and at a shift change on every channel. Live video with no playback means the schedule is off or the disk is not writing.
How many days of CCTV footage should a factory keep? Indian law sets no single number for every factory; state conditions, buyer audits and your needs set it. Scroll playback to the oldest footage to see what you actually keep.
Do I have to replace my cameras because of the 2026 certification rules? No, not on that basis alone. From 1 April 2026 the rule stops the sale of IP cameras that do not meet MeitY's Essential Requirements; analogue cameras need only the IS 13252 test report. Nothing requires a private factory to remove working installed cameras; the rule matters when you extend the system or buy replacements.
What is RTSP/ONVIF and why should an owner care? Standard ways for cameras to share video and settings with other software. With them you can add analytics or change recorders without replacing cameras.
Can I do this audit without the installer? Mostly yes, with a playback login. Only the RTSP/ONVIF question may need the maintainer.