An access policy is a short written document. It says who may watch your cameras, who may review recordings, and who may hand footage to anyone outside. Management approves it, and everyone who uses the console follows it. This guide helps facility managers write a simple one.
Before you start
- List everyone who uses the SSMS console today, and what they do with it.
- Find out who in management can approve the policy.
- Read privacy and responsible CCTV use. The two documents work together.
Why you need a written policy
Without clear rules, people watch footage out of curiosity. Copies leave the building. Later, nobody can say who saw what. A written policy fixes this. It also helps new staff learn the rules quickly.
This guide is about your organisation's rules, not software settings. Whether SSMS can enforce different access levels for each person is not in its confirmed capability list. If you need that, ask Skyline to confirm in writing.
Start from least privilege
Least privilege means each person gets only the access their job needs. Nothing more. An operator who watches the gate does not need to hand footage to the police. An IT admin who keeps the server running does not need to watch recordings.
Ask one question for every person: what must they do with the cameras to do their job? Give access for that, and stop there.
Typical duties
Use this table as a starting point. Change it to fit your site.
| Who | May do | Should not do |
|---|---|---|
| Operators | Watch the live wall. Review recordings when a supervisor asks. | Hand footage to anyone. Review recordings out of curiosity. |
| Supervisors | Approve reviews of recordings. Approve copies. Check the access register. | Send footage outside without management approval. |
| IT admins | Keep the server, disks and network running. Fix offline cameras. | Watch footage as a routine. |
| One named manager | Approve requests from outside, such as the police. Own the policy. | Approve anything without writing it in the register. |
Requests from outside
Outside requests may come from the police, an investigator, a lawyer or an insurer. Route every one through one named person. That person checks the request, approves or refuses it, and records the decision in the footage access register.
In Saudi Arabia, the Law on the Use of Security Surveillance Cameras sets a clear limit for the facilities it covers. Recordings may not be transferred or published without the approval of the Ministry of Interior or the Presidency of State Security, a court order, or a request from the competent investigating authority (Article 6).
Source: the law as published in the Umm Al-Qura gazette. This is orientation, not legal advice. Outside Saudi Arabia, follow your local law. For how to make and hand over a copy, see handing over footage safely.
Rules for the console room
- Keep the door locked when the room is empty.
- Allow only named staff inside. Visitors sign a visitor log and stay with a staff member.
- Place screens so people outside the room cannot see them.
- No personal phones pointed at the screens.
One person, one sign-in
Never share sign-ins. If two people use one sign-in, you cannot tell who did what. If you were given a personal sign-in, keep it to yourself. For password rules, see keeping SSMS secure.
Joiners, movers and leavers
- Joiner: a new person gets access only after training and after signing the policy.
- Mover: when someone changes job, review their access the same day.
- Leaver: remove their access on their last day.
Ask your IT admin or Skyline how sign-ins are handled in your deployment. Then you know how to carry out these steps.
A simple policy outline
Your policy can fit on two pages. Cover these points:
- Purpose: why the site uses CCTV.
- Scope: which sites and cameras the policy covers.
- Who may do what: the duties table.
- How to ask for a review or a copy, and who approves it.
- Outside requests: the named person and the steps.
- Console room rules.
- Sign-in and password rules.
- Joiners, movers and leavers.
- Records: the footage access register.
- Review date.
Review the policy every year
Read the policy again at least once a year. Also review it after a serious incident, after adding a site, or when the law changes. Check that the list of people is still correct.
Where to go next
- Keeping a footage access register
- Handing over footage safely
- Keeping SSMS secure: passwords and workstations
- Privacy and responsible CCTV use
Quick checklist
- A written access policy exists, and management has approved it.
- Each person has only the access their job needs.
- One named person handles every outside request.
- The console room is locked and visitors are logged.
- Nobody shares a sign-in.
- Leavers lose access on their last day.
- The policy has a review date.
Comments
0 total · 0 threads