Before You Close for the Holidays: A Year-End Security Audit for Your CCTV and Alarms

Why the Holiday Shutdown Is the Riskiest Week of the Year for Your CCTV

Most Philippine shops, clinics, and offices lock up on the last working day before December 23 and nobody walks the floor again until the first week of January, the longest unattended stretch of the year. That is when a disk that quietly failed in October, a UPS battery that now lasts four minutes, or an ex-employee's still-active phone app becomes a real problem. Run this CCTV maintenance checklist before you hand over the keys.

This is not a shopping list: five passes (cameras, recording, power, access, alarms) plus the paperwork, all of it one afternoon's work with a ladder, a cloth, and a flash drive.

NPC Circular No. 2024-02 has governed CCTV in public and semi-public areas since August 27, 2024, and it says retention must not be determined by storage capacity alone, so "whatever fits on the disk" is no longer defensible. Early November's storms, Tino (Kalmaegi) and Uwan (Fung-wong), also left many recorders with corrupted disks, wrong clocks, or no power.

Print it, tick each item, then sign and date the sheet: that record is what matters in January, and the discipline behind our cybersecurity services for Philippine SMEs.

Pass 1: The Camera Walk — Lenses, Angles, and Night Coverage

• Clean every lens and dome bubble. Dust, cobwebs, and lizard droppings are the top reason footage turns out useless. Microfiber only.
• Check each camera at night, lights off. Infrared washout, new Christmas decor in frame, and signage LEDs flaring the sensor are December problems.
• Confirm the four spots that matter: main entry, back door, register or safe, stockroom. A camera framing only a corridor is decoration.
• Inspect housing seals, glands, and drop wires after last month's storms. Water inside a housing shows up as lens fog weeks later.
• Match the live view to the channel labels, so nobody learns mid-incident that CAM 3 is not the back door.

Blind-spot test: the two-person walkthrough

One person walks an intruder's likely route (fence, back door, stockroom, register) while the other watches the monitor and notes every second the walker vanishes. Log the gaps as a January quotation item. A long list is where clients start asking about CCTV with AI analytics, people counting, and instant alerts.

Pass 2: Recording and Retention — Make the NVR Prove It

Your NVR (network video recorder, the box the cameras write to) will show a green "recording" icon while saving nothing usable.

• Scrub back 7, 14, and 30 days on three channels. Gaps mean a failing disk or a motion setting nobody meant to enable.
• Export one clip and play it on a laptop. Proprietary files that open only on the NVR are useless when a barangay officer or insurer asks for one.
• Check the disk. The S.M.A.R.T. page (the drive's own health report) shows whether you have a surveillance-rated drive, WD Purple or SkyHawk class, or a desktop drive dying under 24/7 writes.

The circular is explicit: keep footage only as long as the declared purpose needs, never let capacity set the retention period, write it into your CCTV policy, and destroy recordings when they are no longer needed. Decide the period first, then size the storage to it (channels × bitrate × hours × days), which is ordinary CCTV and IoT integration work. If your policy says 30 days but the disk overwrites at 11, lower the frame rate, add a drive, or amend the policy.

Set the clock before you leave

Point the NVR at an NTP server (network time protocol, automatic clock sync) and confirm Philippine time, UTC+8. A clock that drifted during a power event produces timestamps nobody will rely on, and cheap recorders reset to 2015 on every restart.

Pass 3: Power — The UPS, the PoE Switch, and the Restart Plan

November made the argument for us. Typhoon Tino (Kalmaegi) blacked out Bacolod City and five neighboring localities, cutting power to 250,059 Negros Electric and Power Corp. consumers, and around 7 million nationwide were without electricity at the peak. Days later, Super Typhoon Uwan (Fung-wong) left roughly 3 million households in the dark. NGCP restored the affected Luzon lines inside a week; the DOE targeted a month for full restoration. A closed store can sit unpowered for days with nobody noticing.

• Back up the whole chain: NVR, PoE switch, and router or ONT. (PoE, Power over Ethernet, feeds cameras through their network cable.) A UPS on the recorder alone leaves no cameras and no remote view.
• Test the UPS under load. Unplug it and time the real runtime; batteries three years and older give minutes, not the hour they once did. See our guide to protecting your equipment with a UPS and a power plan.
• Enable auto-restart ("last state on power resume"), then tape a startup order inside the cabinet: modem, router, PoE switch, NVR, monitor, plus a number to call if January's screen stays black.

Pass 4: Who Can Still See Your Cameras Over the Break?

• List every account on the NVR and the app, then delete anyone who left in 2025. Ex-staff with a live remote-view app is our most common year-end finding.
• Kill default credentials (admin/admin, admin/12345) and shared "store" logins. Give the two people who will actually watch the feed named accounts with two-factor authentication.
• Prefer a VPN over exposing the NVR to the internet. If ports are forwarded, disable UPnP, change the defaults, and patch the firmware now, not during the break.
• Change the router admin and WiFi passwords if holiday temps had them, and name who is on call, with agency, barangay, and PNP numbers on one sheet.

That list is evidence too: your CCTV policy must name who may access, provide, or dispose of recordings.

The paperwork the NPC expects to see

The National Privacy Commission's rules on CCTV systems ask for concrete things: visible notices at points of entry or other conspicuous areas, still readable and not hidden behind tinsel; a stated legitimate purpose such as security of property, public order and safety, or compliance with law; a written policy naming who may access, provide, or dispose of footage, with the retention period in it; and a privacy impact assessment. No policy yet? Draft one page this week, then read what the NPC actually expects from small businesses handling customer data.

Pass 5: Alarms, Sensors, and the Human Handover

• Trigger the alarm for real. Arm the panel, open a door, confirm the siren sounds and the alert reaches a phone somebody answers. Untested chains point at old numbers.
• Check the panel's backup battery (sealed lead-acid, three to five years) and the sensors: contacts loosened by ceiling work, a motion sensor now aimed at stacked stock.
• Learn how your locks fail: shutter, padlocks, electronic locks, RFID readers. Find out before a power cut answers for you.
• Update the emergency contact sheet (who lives nearest, who holds keys, who can meet responders at 2 AM on December 26) and book one mid-break check-in around December 27 to 29, in a named person's calendar. "Someone will check" means nobody checks.

The Print-and-Tick Pre-Holiday CCTV Maintenance Checklist

Cameras

1. Clean every lens and dome bubble.
2. Review all cameras at night, lights off.
3. Confirm coverage: entry, back door, register, stockroom.
4. Check housings, seals, drop wires, and channel labels.
5. Walk the route; note the blind spots.

Recording

1. Scrub back 7, 14, and 30 days.
2. Export one clip; play it on a laptop.
3. Check S.M.A.R.T. status and drive age.
4. Confirm the retention period against real capacity.
5. Sync the clock to NTP; confirm UTC+8.

Power

1. Put NVR, switch, and router on the UPS.
2. Unplug the UPS; time the real runtime.
3. Enable auto-restart on the NVR and switch.
4. Power-cycle once; watch it return unattended.
5. Tape the startup order inside the cabinet.

Access

1. Delete accounts of staff who left in 2025.
2. Remove default and shared logins.
3. Turn on two-factor authentication.
4. Update firmware; close forwarded ports.
5. Change the router admin and WiFi passwords.

Alarms and paperwork

1. Arm the panel; confirm siren, alert, battery, and sensors.
2. Confirm how each lock behaves without power.
3. Post the contact sheet; book the mid-break check-in.
4. Check the notices, the policy's purpose, and its retention period.

Checked by: ____________________ Date: ____________

Triage honestly: recording, power, and access must be fixed before you lock up; extra cameras and cabling wait for a January quotation. In January, re-check the clock and the recording after the first power interruption of 2026, and fold what you deferred into the 2026 budget while the signed CCTV maintenance checklist is still on your desk.

If every box is ticked, lock up and enjoy the break. If it turned up dead disks, a UPS that lasts four minutes, or accounts nobody can explain, book a call with us before your last working day: we will run the audit with you, hand over a signed maintenance record, and quote the January fixes separately.