Staff Leaving? Revoke Their CCTV Access the Same Day

When a CCTV operator leaves, close every way they could still see your cameras on their last working day. Disable their personal account, end any login still open on a phone or control-room PC, change shared recorder passwords they knew, remove them from the mobile app, and keep their activity history for later review.

Most teams do the first step and stop. The account disappears from the user list, everyone feels the job is done, and the former operator can still open the recorder from home with the admin password everyone on the night shift knew.

Why isn't deleting the account enough?

CCTV access rarely lives in one place. A typical site has a video management application (the VMS, where operators watch and review footage), one or more recorders (NVRs) with their own logins, cameras with their own logins, and often a phone app that reaches the recorder through the manufacturer's cloud. Removing someone from one of these leaves the others untouched.

The last day itself is a risk window. In September 2025, New Zealand's licensing authority for private security workers cancelled a technician's certificate after he opened footage of a serious workplace accident from a client's security system on his final day of employment and sent it to two friends. One of them shared it, and the clip spread widely online, damaging both his former employer and their client (1News, 2 September 2025). He said he had not acted out of malice. The damage happened anyway, and it happened while his access was still perfectly valid.

In Indonesia, footage that shows identifiable people generally counts as personal data, and Article 39 of the Personal Data Protection Law requires the data controller to prevent unauthorised access to it (UU 27/2022). A former employee who can still log in is exactly that kind of access.

Where can a former operator still get in?

Walk through every route before the last day, not after. This table covers the places I check on most sites.

Two rows deserve extra attention.

Open logins. Many applications keep you signed in for as long as you keep using them. In the Pantau CCTV management project, a session (the "still logged in" state after entering a password) extends itself while it is in use, so a browser left open in the control room never times out on its own. Deleting the user or changing their password ends every session they hold. Other products behave differently, so test it: after disabling the account, refresh the screen they last used and confirm it asks for a password.

Cloud app links. Some recorders can be tied to an account in the manufacturer's phone app, which lets the owner view cameras from anywhere and share access with others. If an employee linked the company recorder to their own personal app account, that person effectively owns remote access. Hikvision notes that a factory reset does not remove a device from its Hik-Connect account; the device must be unbound or deleted from the account itself (Hikvision support). Keep these links under a company-owned account, never a staff member's personal one.

Should you disable the account or delete it?

Disable first. Delete later, if at all.

A disabled account cannot log in, but its name still appears in the activity history: who watched which camera, who played back footage, who exported a clip. That history is what you will need if a recording turns up on social media three weeks after someone leaves.

In some systems, deleting a user also deletes or orphans the records linked to it. Ask your vendor, or test with a dummy account. In Pantau, activity records store the operator's name alongside each action rather than depending on the account still existing, so the history survives when an account is removed. That is a design decision worth checking in whatever system you use.

What about the passwords everyone shares?

A shared account cannot be removed for one person. The only fix is to change its password whenever someone who knew it leaves. The US government's security control catalogue spells this out: organisations should change the password of a shared or group account when an individual is removed from that group (NIST SP 800-53 Rev. 5, control AC-2).

Recorders make this harder than it sounds. The admin account usually cannot be deleted, and the same password is often stored inside the VMS, the analytics server, and any integration that pulls video. Change it in the recorder alone and those connections fail, sometimes silently. Recording may stop with nobody noticing until footage is needed. So:

1. List every system that logs in to each recorder and camera with that password.
2. Change the password, then update each system immediately.
3. Confirm live view and playback still work on every recorder.

Stolen passwords are still a major way in. Verizon's 2026 Data Breach Investigations Report, covering incidents from November 2024 to October 2025, found that software vulnerabilities (31% of breaches) have only now overtaken stolen credentials as the most common entry point (Verizon DBIR 2026). A password that a former employee still knows is a stolen credential waiting to happen.

The long-term fix is to stop sharing. Give each operator a personal account in the VMS and keep the recorder password with the system, not with people. Every operator is then removed in one place, and the recorder password only changes when an administrator leaves. The CCTV user access guide explains how to divide access by role.

In what order should you revoke access?

For a planned resignation, run the list at the end of the final shift. For an abrupt dismissal, agree the timing with HR so access closes during the conversation, not after it. Role changes deserve the same care: a supervisor moving to the warehouse no longer needs lobby cameras.

What should you look for in their activity history?

Check the final few weeks for anything unusual: exports or downloads, playback of areas outside their normal duties, logins outside their shifts, and permission changes. Most of the time there is nothing to find. When there is, you want to know before a clip appears somewhere public.

This review only works if the system records those actions. Ask your vendor which actions the activity log captures, and look at a real example before you need it.

Make it part of the HR exit list

Access removal fails when it depends on someone remembering. Add one line to the HR exit checklist: "CCTV access revoked and confirmed by [name]". Keep a simple register of who holds which CCTV access, including shared passwords, so the person doing the revocation knows what to change. The same risk of knowledge held by one person is covered in the article on bus factor.

If your current system makes this hard, with shared logins, no activity history, or recorders linked to personal apps, it can usually be fixed with configuration before anything is replaced. For linking existing recorders to a system that matches your staff structure, see IoT system development.

Tell me how CCTV access is managed on your site. The initial 15-minute discussion is free. Surveys, configuration, and development are scoped after we discuss your site.