Quick answer: IP cameras can be part of a well-protected system, but no camera or app makes a site secure on its own. Use unique credentials, named accounts, restricted network access and a planned update process. Then confirm the exact model, firmware and software capabilities before answering the customer’s security questionnaire.
On this page
Why do customers ask, and what are they really asking?
Camera systems made the news for the wrong reasons: recorders left on default passwords, login pages exposed to the internet, cameras recruited into botnets. So the question now comes up in sales meetings, in IT security reviews and in vendor questionnaires attached to a bid. The person asking is rarely after a lecture on encryption. They want to know three things: can someone outside get in, can someone inside see more than they should, and will this system become their problem in three years.
Start with what you can demonstrate on this installation. Product design, supported firmware, the customer’s network and day-to-day access management all matter. A useful answer says what is configured now, what has been tested and what still needs written confirmation.
| Customer asks | Evidence to show | Who confirms it |
|---|---|---|
| Who can view video? | Named-user and permission list; approved remote-access method | Installer and customer administrator |
| Is traffic or storage encrypted? | Exact model, firmware, protocol and deployment statement | Model-specific documentation and support |
| What happens after handover? | Update owner, access review and incident contacts | Customer and service provider |
What is the right answer pattern?
Use the same structure for every question, so your answers stay consistent across salespeople and technicians:
- What we do on every installation. Your practice: passwords, accounts, network design, firmware schedule.
- What the product supports today. Stated per model, firmware and software version, never as a general promise.
- What we confirm in writing. Anything that will be relied on in a contract, a bid or an IT approval.
| Say | Do not say |
|---|---|
| Supported today on this model and firmware | It will support that in the next update |
| We confirm it per model and project | All of our products do that |
| Here is the per-SKU documentation | Trust us, it is fully compliant |
| We reduce risk with these steps | It cannot be hacked |
| Required profiles, confirmed for the exact device and client | It works with any system |
Questions 1 to 4: passwords, access and the network
1. Does the system ship with a default password?
Whatever the device’s first-boot state, the answer you give is about your practice: every recorder and camera gets a strong, unique password at commissioning, never reused from another site, stored in your password manager and handed to the customer securely. Our NVR hardening checklist lists the full set of steps.
2. Who can see our cameras?
List every path to the system: local recorder users, app or remote-service access, third-party integrations and service accounts. Give each person an individual account and only the permissions they need, where the platform supports them. Test revocation rather than assuming that removing one account closes every route. The customer should know who holds administrator access and whether your company retains access under the service agreement.
3. Do you open ports on our firewall?
Avoid exposing recorder or camera login and streaming ports directly to the internet. Agree the remote-access method with the customer’s IT team; a managed VPN may be appropriate. CASE Connect is the primary CASE software experience on mobile and on the web, but that statement alone does not establish a particular remote-viewing transport or its security controls. Confirm the exact deployment. Our P2P, port forwarding and VPN guide explains the questions to ask.
4. Can the cameras reach the rest of our network?
Restrict camera traffic to the destinations the design actually needs. A camera VLAN or an NVR’s own PoE network can help separate traffic, but the label alone does not prove isolation. Check routing, firewall rules, management access and any recorder bridging or camera-access feature. Use the camera network-segmentation guide with IT and test the intended boundaries.
Questions 5 to 8: storage, encryption and cloud
5. Where is our video stored?
Document every recording destination: the on-site recorder, configured camera memory cards and any separately approved backup or remote service. State the retention period and who can export footage. A memory-card slot does not prove that edge recording, failover or automatic backfill has been configured or supported. See on-site recording and cloud-storage scope.
6. Is the video encrypted?
Give a precise answer, not a general yes. Use HTTPS for the web interface where the firmware offers it, keep web and stream ports off the internet, and state stream and storage encryption options only as confirmed per model and firmware. If the IT team needs a specific encryption statement, request it in writing for the exact SKUs.
7. Does any of this go to the cloud?
Separate an app connection, remote configuration and video storage in your answer. CASE Connect, on mobile and on the web, is the primary CASE software direction. CASE Station desktop and CASE Cloud remote NVR configuration are separate names. CASE Cloud’s documented P2P configuration role is not evidence of cloud recording or of every CASE Connect viewing feature. Confirm storage destinations and data flows for the actual project in writing.
8. Do we have to install a browser plug-in?
Check the exact model, firmware, browser and functions the customer needs. A plug-in-free login page does not necessarily establish that every live-view, playback, export or analytics function behaves identically in every browser. Record the browser versions and functions tested at handover.
Questions 9 to 12: maintenance, compliance and integration
9. Who updates the firmware, and how often?
Agree who owns updates and how urgent security notices are handled. Review releases on a planned schedule, and review relevant security advisories as they arrive; do not wait for the next routine visit when an urgent issue needs assessment. Test the approved firmware in a maintenance window and retain the version log. Use the firmware maintenance calendar and obtain the correct files through the Anabon Download Center or technical support.
10. What happens if something does go wrong?
The recorder keeps logs, time is synchronized so the logs are usable, and you have an incident procedure: preserve evidence, cut external access, change credentials, recover and report the facts. The steps are in incident basics for installers.
11. Is it NDAA compliant, and where is it made?
Use the documentation answer for both. CASE offers NDAA-compliant options for compliance-sensitive projects. Anabon confirms the exact products and provides the official compliance documentation for each project. On origin: Product documentation is supplied per SKU. For any project with origin, NDAA, or other compliance requirements, Anabon provides the official per-SKU documentation and project-specific confirmation. TAA status is likewise confirmed per SKU.
12. Will it work with our existing video platform?
Confirm the exact device and client model, firmware, supported ONVIF profile and functions required by the project. Do not turn a profile name into a promise that all analytics, audio, events or exports will work. Check the official ONVIF conformant-product records where conformance is required, then test the actual combination. Use a separate service account for an integration where supported.
When should you ask Anabon for a written statement?
A spoken answer is fine in a sales conversation. Ask for a written, dated statement when the answer will be relied on by someone else:
- A vendor security questionnaire from the customer’s IT or risk team.
- A bid or RFP with NDAA, TAA or other compliance clauses.
- A question about a software capability, cloud scope or app feature that will be written into a contract.
- An insurer, auditor or consultant asking for documentation rather than an opinion.
| Request | What to send Anabon | What you receive |
|---|---|---|
| Compliance documentation | Full SKU list and project name | Per-SKU documentation and project-specific confirmation |
| Software or security scope | The exact questions, SKUs, firmware and deployment method | A written answer on what is supported today |
| Integration question | Platform name, version and the functions required | Confirmation per platform and project |
Send the request through your business account or contact us, and keep the reply in the project file. Never fill in a questionnaire line with yes because the answer is probably yes.
What to tell your customer
Suggested customer wording: “Here is the access list, network design and update plan for your system. These are the controls we configured and tested. Where your IT team needs a formal answer about encryption, software or compliance, we will request documentation for the exact equipment and deployment.”
FAQ
Are IP cameras secure enough for a business network?
They can be suitable when the products and deployment meet the customer’s requirements. Review supported firmware, credentials, access permissions, network restrictions and the maintenance plan. Record remaining limitations. A secure installation reduces risk; it does not justify a claim that a system cannot be compromised.
Can an IP camera be hacked through the app?
An app is another access path to assess, not proof that compromise is impossible. Check authentication, user permissions, session removal and the confirmed transport for the exact model and software. Keep app and device software current through approved sources. P2P does not by itself establish end-to-end encryption or a security guarantee.
Does the video go to a cloud recording service?
Check the actual configuration. On-site recorder storage, camera-card recording, remote configuration and cloud video storage are different functions. Do not describe CASE Cloud remote NVR configuration as cloud recording. Confirm any required storage destination and software capability for the project in writing.
How do I answer a customer’s IT security questionnaire?
Answer the installation-practice questions yourself, from your own checklist and handover file. For product capability, compliance and software scope, send the exact questions, SKUs, firmware and deployment method to Anabon and use the written reply. Never answer yes to a line you have not confirmed, because the questionnaire becomes part of the customer’s record.
For a new project, compare IP cameras against the customer’s documented requirements. Send the full SKU, firmware and deployment questions to Anabon technical support; a product-family description is not a substitute for that review.
