A camera can be recording normally while nobody knows which account administers it, whether updates are available, or how its installer connects remotely. The picture on the screen is only one part of operating the service.
Keep the camera's function maintainable
Its picture is only one part of a product that may include an app and controller or cloud service.
Treat connected equipment as an asset with an owner and a purpose. Include cameras, displays, sensors, printers, environmental controls, and other devices joining the network. Their operational importance may be much greater than their size or purchase price suggests.
Ask the support questions before connecting it
Identify the department responsible for the function, the installation provider, the device and software, and the account controlling it. Check support dates, update arrangements, backup or export capabilities, and the effect of a provider or cloud outage.
NIST's IoT device capability baseline provides a starting point for evaluating cybersecurity capabilities when acquiring or integrating devices. Use it to ask specific supplier questions rather than assuming every device supports the same controls.
Our connected-device guide covers inventory, maintenance, provider access, and retirement. Include the full product: a device may depend on a mobile app, cloud account, gateway, or controller that also needs administration.
Replace default or shared setup credentials through a supported process. Give technicians named access where possible, protect administrative accounts, and document how access ends when a contract changes. Do not leave remote support permanently available simply because it was needed for installation.
Define the paths the function needs
Determine which systems the device must contact and which services need to contact it. Plan the network boundaries with the application or operational owner. A device may require a controller connection without needing broad access to office workstations or administration interfaces.
Use network segmentation to enforce and test the intended paths. A separate wireless name or VLAN label alone does not establish which traffic is permitted. Include management access and relevant address families in the checks.
Understand what information the equipment captures or transmits. Images, occupancy data, logs, and audio can create records and privacy considerations. Establish access and retention with the responsible information owner before enabling optional collection.
Maintain the function through change
Agree how updates will be evaluated and applied. A routine reboot may interrupt access, building operation, or another essential service, so maintenance needs appropriate coordination and a fallback. Conversely, an operational dependency should not become an undocumented reason never to update equipment.
Record configuration and the information needed for recovery. Have someone other than the installer demonstrate the approved administration and support route. Check that another authorized person can contact the provider during an absence.
When the product becomes unsupported, place the decision on the asset lifecycle plan. A replacement should include transfer of required records, removal of obsolete accounts and cloud connections, and suitable sanitization.
Claims about AI, edge computing, or a blockchain feature do not answer these operating questions. The department needs evidence of the controls its use requires and a clear record of the limitations it has accepted.