CCTV maintenance checklist for Auckland

Most CCTV systems fail silently. The cameras keep streaming, but the footage gets blurry, the NVR storage fills with old data instead of writing new, the firmware runs vulnerable code, and the user accounts list every leaver who ever had access. Then there’s an incident, you go to pull footage, and it’s either gone, useless, or unreachable. About two hours a year of basic maintenance prevents almost all of this. This is the checklist we use on Comsys maintenance contracts.

Annual checklist (do once a year, ~2 hours total)

1. Physical camera check (~30 minutes)

• Inspect each camera for lens dust, spider webs, and water staining. Wipe with a microfibre cloth dampened with isopropyl alcohol — not glass cleaner (the ammonia damages lens coatings).
• Check mount integrity. Coastal sites (Mission Bay, Devonport, Howick, Half Moon Bay) get salt-air corrosion on bolts and brackets. Replace any rusted fixings with stainless.
• Confirm each camera is still pointing where it’s supposed to. Wind, ladders, and curious cats nudge cameras over time. Re-aim if needed and re-confirm framing on the recorded footage.
• Look for IR-illuminator cobwebs — spiders love the warmth of IR LEDs and their webs trigger motion alerts.

2. NVR / recorder health (~20 minutes)

• Check NVR is powered, the disk indicator is green, and the system clock is accurate (within a minute of NTP).
• Confirm S.M.A.R.T. status on each disk. Drives with reallocated sector counts climbing should be replaced before they fail. Most NVRs surface S.M.A.R.T. data in the maintenance menu.
• Verify retention is what you specified. If you set 30 days but the disk only holds 22 days, either the recording resolution has crept up or the disk has degraded; fix one or the other.
• Confirm overwrite mode is on. The most common failure mode is “disk full, no overwrite” — system stops recording and you don’t notice.

3. Software and firmware (~20 minutes)

• Check NVR firmware version. Apply security updates from the manufacturer (Hikvision, Dahua, Axis, Uniview all release periodically).
• Check camera firmware on at least one camera per type. Apply if vulnerabilities have been published.
• Update the management app on phones used for live and recorded viewing.

4. Users and access (~15 minutes)

• Review user list. Remove leavers, retired roles, ex-tenants. Most systems we audit have 30–50% of accounts no longer in use.
• Force a password reset on the admin account. The default password from install day is the most common breach vector.
• Confirm two-factor or strong-password rules for any cloud / app access.

5. Network and remote access (~15 minutes)

• Confirm the NVR is reachable from each phone or tablet that needs to view it. Re-pair if the network has changed.
• Check that the NVR is not exposed directly to the internet via port-forward (a 2024-era best-practice; use cloud relay or VPN).
• Test live and recorded playback from off-site (e.g. on mobile data, not wifi).

6. Privacy compliance (~10 minutes)

• Review your retention period under the Privacy Act 2020. If 30 days is no longer enough or 90 days is now overkill, adjust the NVR setting and document the change.
• Confirm signage is still in place at entries and visible from the public street.
• Check privacy masks on cameras facing public space or neighbouring property are still applied (firmware updates occasionally reset masks).

Quarterly checks (5 minutes)

• Pull a recording from each camera at random and confirm playback works.
• Confirm push notifications are still arriving on at least one phone.
• Check S.M.A.R.T. status on the NVR disk.

What we do on a Comsys maintenance visit

For sites we manage on a maintenance contract, we run all of the above plus an in-person visit: physical camera clean, lens re-aim, mount-bolt check, IR-illuminator spider-web removal, NVR clock sync, firmware check, and a written maintenance report. Most residential sites are 60–90 minutes; commercial sites are 2–4 hours depending on camera count.

Common failures we find on first visit

• NVR clock 6+ months out of date. Recording timestamps are useless for evidence.
• Firmware from 2018. Known vulnerabilities still on the device.
• Disk full, recording stopped 3 weeks ago. Owner thought everything was fine because the cameras still showed live.
• Default admin password. Often “12345” or the installer’s phone number.
• Privacy masks reset by firmware update. Now recording the neighbour’s property by accident.

Read next

CCTV installation services · CCTV cost guide · security audit checklist