10.3 Data Storage, Retention, PII & Physical Network Security
Key Takeaways
- Choose cloud or on-premises VMS and access-control storage from connectivity, latency, legal hold, and who can administer accounts—not from a slogan.
- Retention schedules differ for routine video, incident clips, access logs, and visitor identity data; legal hold overrides ordinary deletion.
- Unique least-privilege accounts and audit logs are access-control features of the security system itself, including shared ‘guard’ logins.
- Token ring is obsolete LAN knowledge; current security networks are switched Ethernet TCP/IP with static or reserved addresses and VPNs as needed.
- Physical network security is locks on IDF/MDF rooms, protected cable pathways, unused ports shut down, and vendor access through a jump host.
Security data is evidence, operations memory, and PII
Principles of data storage and management on the PSP exam are not an IT elective. Video management systems (VMS), network video recorders, and access-control servers hold footage of people, license plates, visitor identity documents, biometric templates, and door histories. That mix is personally identifiable information (PII) in most privacy regimes, and it is potential evidence. A design that “keeps everything forever on the cheapest disk” and a design that “auto-deletes at 72 hours because storage is expensive” can both be wrong for the same site.
Cloud versus on-premises VMS and access control
On-premises VMS and access-control servers keep media and databases in rooms you lock, power, and cool. Advantages are local live-view when the WAN is down, clearer data-residency control, and no per-camera subscription surprise. Disadvantages are patching discipline, RAID and backup jobs that security staff may not actually perform, and a single mechanical room that is both the heart of video and a water-pipe target.
Cloud video (VSaaS) and access control (ACaaS) move storage and application logic to a vendor tenant. Advantages are geographic redundancy the owner would not build, simpler remote administration, and off-site copies if a recorder is stolen in a burglary—the classic “they took the DVR” failure. Disadvantages are WAN dependence for live view and archive, contract questions about who can see video (vendor support staff included), encryption of data in transit and at rest, and exit costs when you want your footage back. Hybrid designs—edge recording on the camera or a local server with cloud copy for incidents—are common and should be described as two retention clocks, not one.
Redundancy is not a brand name. RAID is not a backup. You want independent copies (another disk array, another building, or cloud replication), tested restores, and a failover path for the access-control decision engine so doors do not fail into an unsafe state because a SQL server rebooted. Document whether readers work from local panel cache during a server outage.
Retention, permissions, and regulatory clocks
Write a retention schedule as a table, not a hallway rumor:
- Routine video: often 14, 30, 45, or 90 days depending on risk, storage, and sector custom. There is no universal legal number for every private office; do not invent one on the exam. State what the owner’s counsel and insurer require.
- Incident and case clips: legal hold until the investigation, claim, or prosecution closes—copied off the rotating buffer so ordinary wraparound does not erase them.
- Access-control logs and alarm histories: commonly months to years for audits and after-action reviews.
- Visitor ID images and contractor watchlists: keep only as long as the privacy notice and law allow; a reception binder of photocopied licenses with no destruction date is a PII incident waiting for a request.
Regulatory retention overlays the owner’s preference. Treatment-area cameras that could capture protected health information implicate HIPAA-style safeguards in U.S. healthcare. Payment-lane cameras that can see PIN pads conflict with PCI rules—point them somewhere else. Public-sector and European operations add records laws and GDPR-style minimization. Criminal-justice information on a shared recorder needs CJIS-like access restrictions. The PSP skill is to name the overlay and change storage, access, and masking, not to recite every statute from memory.
User permissions are a physical-security control. Unique named accounts, least privilege (a lobby officer should not export every camera), multi-factor authentication for administrators, immediate removal on termination, and an audit log of who played or exported video are part of the VMS specification. A shared password “guard” on a sticky note makes every clip impeachable and every firing messy. Privileged vendor accounts belong in the jump-host model below, not as standing domain-admin on the recorder.
| Topic | On-premises emphasis | Cloud emphasis | Shared requirement |
|---|---|---|---|
| Live view if WAN dies | Local client still works | Design edge cache or accept outage | Say which doors and cameras must work offline |
| Recorder theft | Attacker has the disks | Off-site copy may survive | Encrypt at rest; lock the room either way |
| Admin access | Your directory, your patching | Vendor staff and your tenant admins | Least privilege, MFA, joiners/leavers |
| Retention | You size the RAID | You buy days in the contract | Legal hold for incidents; PII destruction dates |
| Evidence export | USB and optical policy | Watermarked export and chain-of-custody in the tenant | Who may export, and is it logged |
Network infrastructure: what the Body of Knowledge still lists
LAN versus WAN is the campus switch fabric versus circuits that leave the building. Cameras and panels should live on a security VLAN, not the guest Wi-Fi, and routing to the corporate WAN should be deliberate. A virtual private network (VPN) encrypts that path for a remote building or a home operator. Site-to-site VPNs belong on firewalls you control; “the integrator’s laptop has TeamViewer to every camera” is not a VPN architecture.
DHCP versus static addressing is a reliability and forensics issue. Security devices should use static addresses or DHCP reservations bound to MAC addresses so a camera does not change identity overnight, break firewall rules, and vanish from the VMS. Pure dynamic DHCP is convenient for laptops and hostile to incident reconstruction.
TCP/IP over switched Ethernet is the current default. IPv4 still dominates many physical-security VLANs; IPv6 appears in newer campuses. You need enough addresses, documented default gateways, and DNS that does not depend on a random consumer router in a closet.
Token ring (IEEE 802.5, historically IBM) is legacy knowledge the Body of Knowledge still names. It used a token-passing protocol at 4 or 16 Mbps, often a physical star to a multistation access unit that behaved as a logical ring. Collision behavior differed from classic Ethernet. By the 2000s, switched Ethernet had replaced it in essentially all new work. If an exam item lists token ring beside LAN, WAN, VPN, and TCP/IP, recognize it as an obsolete LAN technology, not as something you specify for a 2026 VMS. Do not “upgrade a ring” in a modern design narrative; migrate to Ethernet.
This section teaches protection of the network you operate. It does not teach how to attack one. You will not find exploit steps, payload construction, or intrusion recipes here. You will find how a PSP candidate specifies closets, cables, ports, and vendor access so that attacking the network is harder and detectable.
Physical network security: IDF, pathways, ports, jump hosts
The main distribution frame (MDF) and intermediate distribution frames (IDFs) are physical-security rooms that happen to hold switches. Lock them to the same standard as other sensitive rooms: card reader or key with key control, door position, maybe a camera covering the door not the screen contents, no coat-rack use by janitorial staff, no water heaters overhead if you can avoid it. An unlocked IDF in a public corridor is an open side door to every camera and lock on that floor.
Cable pathways should not be a pull-down ceiling tile in the lobby. Use lockable trays, conduit in vulnerable public runs, and documented risers. Copper leaving the building needs surge protection (see the transmission section); fiber still needs physical protection because a saw does not care about protocol.
Unused switch ports are live invitations if they sit in a waiting-room wall jack. Administratively shut them down, avoid patching unused drops, and do not leave a live spare “for the next intern.” Wall jacks in public space that must exist should not land on the security VLAN.
Jump-box (jump-host) policy is how vendors support systems without owning the kingdom. The vendor connects to a bastion or jump host in a controlled segment—often with multi-factor authentication, session recording, and time-bounded accounts—and only from there to panels, VMS, or cameras. Direct inbound remote-access tools to every encoder, and standing wide-open VPNs from an integrator’s home PC, are the pattern you are replacing. When the contract ends, the jump-host account ends the same day.
Physical network security is dull on a drawing and decisive in an after-action report: the thief who stole a recorder, the contractor who plugged a rogue switch into a live port, the IDF that was also a storage closet. Specify the locks and the jump host with the same seriousness as the camera count.
The PSP Body of Knowledge still lists token ring beside LAN, WAN, VPN, DHCP versus static, and TCP/IP. How should a 2026 physical-security design treat token ring?
An integrator wants 24/7 remote support to every camera and access panel from home PCs. Which physical-and-network control set best matches a jump-host and closet-hardening approach?
A hospital wants 30 days of routine corridor video, longer keep of incident clips, unique user logins, and a decision between on-premises VMS and a cloud tenant. Which statement is the soundest storage-and-PII practice?