Almost every manufacturer that’s heard of CPCSC asks me a version of this. The engineering files live on the file server, and the cameras just record the shop floor and the parking lot. So the cameras are out of scope, right?
Maybe. But “compliant” is the wrong word to start with.
The short answer
CPCSC certifies how an organization handles Specified Information, the sensitive contract data on its systems. It doesn’t certify products. No camera, NVR, or VMS is CPCSC compliant on its own.
The real question is whether your camera system sits inside the boundary of what you’re certifying, because everything inside that boundary gets every control, documented and proven. That comes down to 3 questions, and you can answer them with a walk around the building and a look at the network diagram.
1. Can it see it?
Walk the floor and look at what each camera actually sees.
A camera over the CAM station can read the screen. One over the inspection bench can read the drawing taped beside the part. One in the assembly bay can see a prototype that isn’t public yet. If a camera can make out Specified Information, the footage can carry it too, along with the exports and the phone app that streams it.
This is the easiest one to fix. Move the camera, narrow its view, or mask the screen or bench. Check which kind of mask your system applies, though; some can be lifted by privileged users on playback. You want a permanent mask applied before the video is recorded.
2. Can it reach it?
On most small-shop networks I walk into, the NVR sits on the same flat network as everything else. Sometimes it’s behind the same consumer modem-router as the CAD workstations.
That makes the camera system a path into the systems holding contract data, whether or not it ever records anything sensitive. Cameras are small computers that rarely get patched, and attackers know it. Add a port forward so someone can check the cameras from home… and the path runs straight in from the internet.
The fix is a network segment of its own, firewalled from the enclave, with only the traffic the VMS needs and no general internet access for the cameras.
3. Does it prove it?
This one surprises people. ITSP.10.171, the standard behind CPCSC, asks you to monitor physical access (03.10.02) and to control it (03.10.07). The second is a Level 1 requirement.
If your recordings and door logs are how you show an assessor who went into the server room, the camera system is protecting the enclave. Systems that protect in-scope systems sit inside the boundary with them.
If any answer is yes
Nothing gets ripped out. The camera system just gets held to the same standard as the rest of the enclave:
- Named accounts for everyone on the VMS, with no shared login on the recorder. Shared NVR logins are one of the most common things I find.
- MFA on remote and mobile access wherever the platform supports it.
- Its own network segment, with firewall rules you could explain in one sitting.
- Firmware patched on a schedule, with a record.
- Exports treated as removable media, so encrypted drives and a log of what left.
- A retention period for video and door logs, written in your system security plan.
- Recorders and door controllers on the same time source as everything else, so the door event, the video, and the login line up.
If every answer is no
Then the camera system can sit outside the boundary, and the job is keeping it there. Put it on its own segment anyway, and keep the masks in place.
Write down why it’s out of scope. An assessor who finds an unexplained NVR on the network will ask, and one sentence in your system security plan answers that before it comes up.
The full decision guide is on the CPCSC hub at hans.study/cpcsc/, and the scoping page covers the rest of the building.