HR recently asked our IT team to find footage from an employee parking lot after an argument between two employees. They only provided a rough time window and an approximate location, so one of our technicians spent about 40 minutes searching several cameras before finding the incident. HR then asked IT to export the clip as well.
This has become a regular pattern, with HR, Facilities, and managers sending camera requests to IT. For organizations that manage surveillance systems, how do you divide responsibility? Do you let approved departments search and export their own footage, or keep access limited to IT, Security, Facilities, or another designated team?
5 Answers
It depends heavily on company size. At smaller organizations without a security team, IT often ends up managing the cameras and pulling footage. At larger organizations, Security, Facilities, Loss Prevention, or Risk usually handles it. A good compromise is to give trained, approved users read-only access for searching while limiting exports and retention holds to a small group.
I would not give broad access to HR or every manager. Camera footage can contain sensitive employee information, and too many people searching freely creates its own problem. Give specific people individual accounts, document the process, require a precise date, time range, camera, and reason, and keep logs of searches and exports.
In most organizations, physical security, Facilities, or Risk should own the day-to-day footage requests. IT can maintain the servers, network, storage, and camera connectivity, but reviewing employee incidents and releasing recordings can create privacy and liability problems. HR or Legal should approve sensitive requests, and every export should have a documented reason and audit trail.
That separation makes sense. IT can still help when the system is broken without becoming the default investigator for every incident.
A practical model is shared ownership: IT maintains the infrastructure and provides technical support, while Security or Facilities handles routine viewing and exports. HR and Legal approve employee-related or legally sensitive releases. If other departments need regular access, train them and give them limited permissions instead of making IT search everything manually.
If IT is still expected to pull the video, make the requester do the investigative part first. Require a narrow time window, exact location, camera number if possible, and an incident or case number. IT should not be expected to scrub through hours or days of footage based on 'sometime after lunch.'
That alone cuts down the wasted time. We provide a short request form and send vague requests back until the department supplies usable details.
We use role-based access for that reason. Managers can view only their assigned areas, while HR or Administration has export rights after approval.