National Security Inspectorate Sentinel House, 5 Reform Road Maidenhead SL6 8BY Website: nsi.org.uk © NSI 2018 This is an unpublished work, the copyright in which rests with the National Security Inspectorate. All rights reserved. The information contained herein is the property of the National Security Inspectorate and is supplied without liability for errors or omissions and no part may be reproduced, used or disclosed except as authorised by contract or other written permission. The copyright and the foregoing restriction on reproduction, use and disclosure extend to all the media in which this information may be embodied. Marking table for CCTV systems installed to NCP 104 (Issue 3) NSF 351.1 January 2018 This marking table is for use by NSI when inspecting CCTV systems that have been installed by NSI NACOSS Gold and NSI Systems Silver approved companies to the requirements of NCP 104 (Issue 3). Demerit points may be given for non-compliance with clauses of NCP 104 (Issue 3) for which no specific reference has been made in the table of deviations listed in this document. Marking table for CCTV systems installed to NCP 104 (Issue 3) NSF 351.1 Page 2 of 11 January 2018 © NSI 2018 NCP 104 (Issue 3) marking table The NCP 104 (Issue 3) marking table is divided into Sections A to P as listed below. Item Title Maximum marks Documentation A Risk Assessment 1 B Site survey 1 C User requirement 1 D System design specification 1 E Installation 1 F Test Plan 1 G Commissioning and handover 1 Technical inspection H Imaging and sensing 2 J Video and audio 2 K Data handling 2 L Networks 2 M Ancillaries 2 N Operations 2 P Installation 2 Notes 1. Each Section of this marking table contains one or more Deviations (see pages 3 to 9 below). 2. Each Deviation is given a Clause reference (for example; NCP 104/17: 7.6, Code H3 and a Point score 2. 3. NSI Inspection Reports detail Deviations by Code, Clause, description of Deviation and Points. Example: H3, NCP 104/17: 7.6, Camera does not perform as defined in the UR/SDS, 2 Points. Marking table for CCTV systems installed to NCP 104 (Issue 3) NSF 351.1 Page 3 of 11 January 2018 © NSI 2018 4. Points are awarded for each individual Deviation as shown in Note 3 above. However, the Maximum Points awarded in any Section are shown in the table above. Example: If two Deviations H1 (1 Points) and H3 (2 Points) are raised under Section H (Imaging and sensing), a total of 2 Points (not 3 Points) are awarded against Section H. 5. The total number of points awarded results in a grading (A to E). A = 0 points, B = 1-2 points, C = 3-5 points, D = 6-8 points and E = 9 points or more. The system will normally require a re-inspection if Grade D or E is achieved. Clause Code Deviation Points RISK ASSESSMENT NCP 104/ 17 : 4 A1 Documented Risk Assessment detailing; targets, locations, occupancy and history of criminality in area not completed. 1 SITE SURVEY NCP 104/17: 5 B1 Documented Site Survey detailing the following has not been comp leted: 1 NCP 104/17: 5 B1A No detail of th e date, time and location of the survey. 1 NCP 104/17: 5 B1B Drawings and/or photographs and/or notes of the proposed location, including detai ls of target and risk locations missing . 1 NCP 104/17: 5 B1C Notes on the approximate distances to target and risk areas (to aid camera and lens selection) missing . 1 NCP 104/17: 5 B1D Candidate locations for system components missing . 1 NCP 104/17: 5 B1E Details of illumination missing . 1 NCP 104/17: 5 B1F Details of l ocal environmental conce rns that may affect the design; for example, foliage, vehicle parking, adjacent public and private property boundaries, and so on missing . 1 Marking table for CCTV systems installed to NCP 104 (Issue 3) NSF 351.1 Page 4 of 11 January 2018 © NSI 2018 Clause Code Deviation Points NCP 104/17: 5 B1G Details of a ny restriction on access and requirements for civil works; for example, power, communica tions, cable routing, and so on missing . 1 Note: Not all points may be applicable in all cases, for example, where a building is in the planning stage. USER REQUIREMENT NCP 104/17: 6 C1 A documented User Requirement has not been completed or does not contain, at a minimum, statements that cover the following requirements: 1 NCP 104/17: 6.1 C1A No detail of the intended purpose of the system and what it is expected to achieve . 1 NCP 104/17: 6.2 C1B No general description of the areas under surveillance . 1 NCP 104/17: 6.3 C1C No or missing details of intended target of surveillance at each location, targets likely speed/direction, purpose of the image captured (image category) . 1 NCP 104/17: 6.4 C1D No image quality requirements for live, playback and export images; tracking and detecting targets; generating alerts/messages . 1 NCP 104/17: 6 .5 C1E No details of systems operational period(s) . 1 Marking table for CCTV systems installed to NCP 104 (Issue 3) NSF 351.1 Page 5 of 11 January 2018 © NSI 2018 Clause Code Deviation Points NCP 104/17: 6 .6 C1F No assessment of environmental conditions, such as; illumination in the target areas (type, hours of operation, lux levels, sunrise, sunset, vehicle lights); potential obstructions to camera views (foliage, vehicles, etc); wildlife, stock, vermin, etc that may affect camera and detector operation or cause damage . 1 Note: Details maybe included in Site Survey documentation . NCP 104/17: 6 .7 C1G No details of any resilience requirements, such as; tampering, protection from power failures, preventing unauthorised access to system software, hardware and networks . 1 NCP 104/17: 6 .8 C1H No details of monitoring, storage and data reten tion requirements . 1 NCP 104/17: 6 .9 C1J Specific or generic export media and file formats not detailed . 1 NCP 104/17: 6 .10 C1K No operational responses identified, if necessary . 1 NCP 104/17: 6.11 C1L No operator workstations and control room (where necessary) requirements detailed . 1 NCP 104/17: 6 .12 C1M Training requirements not identified . 1 NCP 104/17: 6.13 C1N No assessment of requirements for integration and expansion . 1 NCP 104/17: 6.14 C1P No details of audio requirements . 1 NCP 104/17: 6 .15 C1R No assessment of limitations of surveillance . 1 SYSTEM DESIGN SPECIFICATION Documentation NCP 104/17: 7 D1 SDS does not cover all UR and/or take account of limitations identified. 1 Marking table for CCTV systems installed to NCP 104 (Issue 3) NSF 351.1 Page 6 of 11 January 2018 © NSI 2018 Clause Code Deviation Points NCP 104/17: 7 D2 SDS does not have unique reference number and a means to track revisions . 1 NCP 104/17: 7 D3 Agreed SDS not signed off by customer . 1 NCP 104/17: 7.1 D4 SDS does not draw attention to DPA/GDPR and ICO . 1 NCP 104/17: 7.2 D5 Site plan not included in SDS or does not contain all relevant requirements . 1 Imaging and sensing NCP 104/17: 7 .3 D6 Camera and lens information missing or incomplete . 1 NCP 104/17: 7.4 D7 Where a stated requirement, home location and presets not identified for functional cameras . 1 NCP 104/17: 7.6 D8 Field of view and image category not identified for each camera or preset, if functional camera. 1 NCP 104/17: 7.7 D9 Detector/VCA coverage not stated . 1 NCP 104/17: 7.7 D10 Triggers and alerts (cause and effect) not stated . 1 NCP 104/17: 7.8 D11 Illumination requirements not stated . 1 Video and audio NCP 104/17: 7.9 D12 Video/audio formats for storage and export not stated . 1 NCP 104/17: 7 .10 D13 Frame rate not identified for each camera . 1 NCP 104/17: 7.11 D14 Video resolution for camera/system not stated . 1 NCP 104/17: 7 .24 D15 Audio requirements identified in UR not in SDS . 1 Data handling NCP 104/17: 7 .12 D16 No calculation or assumptions made of storage requirements . 1 NCP 104/17: 7.14 D17 No consideration of encryption requirements . 1 Marking table for CCTV systems installed to NCP 104 (Issue 3) NSF 351.1 Page 7 of 11 January 2018 © NSI 2018 Clause Code Deviation Points NCP 104/17: 7.15 D18 Metadata requirements identified in UR not in SDS . 1 Networks NCP 104/17: 7 .19 D19 Network requirements for shared networks and external connectivity not stated. 1 NCP 104/17: 7 .20 D20 Physical and technical security measures not considered during system design . 1 NCP 104/17: 7 .23 D21 No assessment or test plan to ensure integrated systems function correctly . 1 NCP 104/17: 7 .27 D22 Cable protection requirements not identified in SDS . 1 Ancillaries NCP 104/17: 7 .21 D23 Tamper requirements identified in UR not in SDS . 1 NCP 104/17: 7 .22 D24 No calculations for UPS/back up power supplies . 1 NCP 104/17: 7 .28 D25 No assessment of suitability of support structures to withstand expected weight and wind loading . 1 Operations NCP 104/17: 7.25 D26 Control room requirements identified in UR not in SDS . 1 NCP 104/17: 7.26 D27 Workstation requirements identified in UR not in SDS . 1 NCP 104/17: 7 .29 D28 Training requirements not stated . 1 NCP 104/17: 7 .30 D29 SDS does not include a maintenance plan specific to the system and the operational and environmental conditions . 1 NCP 104/17: 7 .30 D30 No assessment of ongoing system security requirements included in maintenance plan . 1 INSTALLATION NCP 104/17: 8.5 E1 No cross reference or running out list/diagram of cabling and equipment . 1 Marking table for CCTV systems installed to NCP 104 (Issue 3) NSF 351.1 Page 8 of 11 January 2018 © NSI 2018 Clause Code Deviation Points TEST PLAN NCP 104/17: 9.1 F1 Tes t plan not agreed with customer. 1 NCP 104/17: 7 .9 F2 Image quality tests not defined . 1 NCP 104/17: 9.1 F3 Test plan does not cover operational period/all system functions . 1 NCP 104/17: 9.1 F4 Results of testing not fully documented . 1 COMMISSIONING & HANDOVER NCP 104/17: 9.2 G1 Commissioning process not completed/documented . 1 NCP 104/17: 9.3 G2 Handover process not completed/documented . 1 NCP 104/17: 9.4 G3 No agreement on holding user accounts and password for maintenance purposes . 1 NCP 104/17: 10.1 G4 Customer documentation incomplete/missing . 1 NCP 104/17: 10.2 G5 Installer documentation incomplete/missing . 1 NCP 104/17: 8.5 G6 Network data cabling installed by the security company has not been tested as required by clause 8.5 . 1 SYSTEM INSPECTION Imaging and sensing NCP 104/17: 7 .4 H1 Functional cameras do not meet UR for pre – sets (if specified) . 1 NCP 104/17: 7 .4 H2 Functional cameras unable to track fastest expected target . 1 NCP 104/17: 7 .6 H3 Camera does not perform as defined in the UR/SDS . 2 NCP 104/17: 7 .7 H4 Detectors operate outside of camera view OR do not detect targets within stated coverage . 1 NCP 104/17: 7 .7 H5 Detection using VCA does not function as required by the UR . 1 NCP 104/17: 7.7 H6 Cause and effect caused by detection of targets does not meet the UR. 1 Marking table for CCTV systems installed to NCP 104 (Issue 3) NSF 351.1 Page 9 of 11 January 2018 © NSI 2018 Clause Code Deviation Points NCP 104/17: 7.8 H7 Poor illumination level, spectral content or cont rast prevents UR from being met. 1 NCP 104/17: 7 .8 H8 Illumination does not operate over operational period . 1 Video and audio NCP 104/17: 7 .9 J1 Video formats do not meet the UR. 1 NCP 104/17: 7 .10 J2 Frame rates incorrectly configured . 1 NCP 104/17: 7 .11 J3 Video resolution not as stated in SDS . 1 NCP 104/17: 7 .24 J4 Audio is not clear and/or does not cover areas identified in UR . 1 Data handling NCP 104/17: 7 .12 K1 Storage does not meet UR . 1 NCP 104/17: 7 .13 K2 Data compression affects quality of images during playback or export . 1 NCP 104/17: 7 .14 K3 Encryption prevents playback or export of images . 1 NCP 104/17: 7 .15 K4 Times stamps not a minimum of 1 sec and/or video and audi o play back is not synchronised. 1 NCP 104/17: 7.15 K5 Where required system does not auto update time between BST and UTC and/or no means provided to update system time . 1 NCP 104/17: 7 .15 K6 Metadata requirements identified in UR or SDS missing . 1 NCP 104/17: 7 .16 K7 System does not audit image enhancement actions, where provided . 1 NCP 104/17: 7 .17 K8 Quality of ex ported data is does not meet UR. 1 NCP 104/17: 7 .17 K9 Original metadata is not exported . 1 NCP 104/17: 7 .17 K10 System cannot export images of specific cameras at defined time intervals . 1 Marking table for CCTV systems installed to NCP 104 (Issue 3) NSF 351.1 Page 10 of 11 January 2018 © NSI 2018 Clause Code Deviation Points NCP 104/17: 7 .17 K11 Simultaneous export and recording not possible (except where primary storage has to be removed for export). 1 NCP 104/17: 7 .17 K12 Export method not appropriate for expected use . 1 NCP 104/17: 7 .17 K13 Time estimated to complete export request not display ed . 1 NCP 104/17: 7 .17 K14 Media player not exported with proprietary video formats. 1 Networks NCP 104/17: 7 .19 L1 Image loss, litter or delay on live viewing or playback caused by network . 1 NCP 104/17: 7 .20 L2 Access to system components, applications and operating systems are not restricted to authorised individuals or processes by the use of authentication protocols and access controls . 1 NCP 104/17: 7 .23 L3 Systems not correctly integrated or has a detriment al effect on co nnected systems and/or networks. 1 NCP 104/17: 7 .27 L4 Cable types do not meet equipment manufacturer’s recommendations or are unsuitable for the installed environment . 1 Ancillaries NCP 104/17: 7 .5 M1 Equipment and housings not fit for expected environmental conditions . 1 NCP 104/17: 7 .21 M2 Cameras field of view or cables not protected from tampering . 1 NCP 104/17: 7 .22 M3 UPS/back up supplies do not meet UR . 1 NCP 104/17: 7 .27 M4 Cables not protected from accidental or malicious damage . 1 NCP 104/17: 7 .28 M5 Masts, towers, brackets and/or supports not stable and secure . 1 Marking table for CCTV systems installed to NCP 104 (Issue 3) NSF 351.1 Page 11 of 11 January 2018 © NSI 2018 Clause Code Deviation Points Operations NCP 104/17: 7.1 8 N1 Displays not suitable for operator task or images are distorted or cropped . 1 NCP 104/17: 7 .25 N2 Control room does not meet UR. 1 Installation NCP 104/17: 8.4 P1 Power supplies not located in a secure area or positioned to prevent/deter tampering or configured to detect and report tampering . 1 NCP 104/17: 8.4 P2 Equipment housings containing mains voltages not marked . 1 NCP 104/17: 8.5 P3 Wiring not installed iaw manufacturer’s requirements . 1 NCP 104/17: 8.5 P4 Cabling not suitably segregated, screened and insulated as required . 1 NCP 104/17: 8.5 P5 Fixed interconnection cabling not suitably supported . 1 NCP 104/17: 8.5 P6 Containment not suitable for environment . 1 NCP 104/17: 8.5 P7 Structured cabling components incompatible. 1 NCP 104/17: 8.5 P8 Access (patch cables) and interconnection cabling of incorrect type . Audit Note only 0 NCP 104/17: 8.5 P9 Cabling not clearly marked at termination points with source and destination information . 1