// HEALTH CHECKS · HANS STUDY · ONTARIO, CANADA
Security system health checks
A structured, independent assessment of a running video or access control system: the servers, the database, the storage, the network, the hardening, and the lifecycle position. Every check ends in the same deliverable, a findings report ranked by consequence and a remediation plan your integrator can price. Seven platforms. One shape of engagement.
Systems drift. The design was right in year one; by year four there are more cameras, a retention policy that got extended after an incident, a SQL database nobody has looked at, and a network the IT team has changed twice. Nothing is broken enough to call anyone about, and that is exactly the state in which the system fails the day it matters.
A health check is the scheduled look. It finds what is wrong while it is still cheap to fix, and it puts the findings in an order that says which ones matter. The failure modes are remarkably similar across platforms, which is why the engagement is the same shape on all seven. The Genetec checklist is free and is a fair preview of the depth on any of them.
By platform
Genetec Security Center
Directory, Archivers, SQL, storage, network, hardening, and lifecycle across a running Security Center environment. The most requested check, and the one with a free checklist to start from.
Milestone XProtect
Management server, recording servers, media database, failover, and the integration seams where XProtect deployments drift.
Avigilon Unity and Alta
ACC servers, data volumes, appliance baselines, analytics load, and the mixed-fleet problems that appear when a system grows past its original camera family.
AXIS Camera Station
Server sizing, recording locations, retention, and the network underneath a Camera Station deployment that has outgrown its original design.
C-CURE 9000
Server, SQL, iSTAR controllers, partitioning, and the integrations that make or break a C-CURE environment at scale.
Lenel OnGuard
Database, communication servers, panel firmware, and the segmentation that an OnGuard estate accumulated over a decade of change orders.
Kantech EntraPass
Workstation and server configuration, controller health, and the network hygiene that keeps EntraPass responsive across multiple sites.
What every health check covers
- Server and platform configuration against the vendor's current hardening and best-practice guidance.
- Database health: edition limits, memory, recovery model, growth, maintenance, retention.
- Storage: actual retention against policy, throughput headroom, RAID and drive condition, free-space behaviour.
- Network: segmentation, PoE budget, multicast, switch configuration on the paths that carry video and doors.
- Hardening: operating system baseline, service accounts, antivirus exclusions, logging, patch position.
- Lifecycle: version against the vendor's support window and the upgrade route from where the system is.
- Operator workstations, integrations, and federation where they exist.
The DHD, a remote access device, can be shipped to site for environments that cannot be reached over the network. The same shape of engagement applies on every platform page.
Delivery and scope
Remote delivery via the DHD, a remote access device, where the system cannot be reached over the network.
How the work is delivered
Screen share, supplied configuration exports, logs and documentation. Most of what a health check examines is visible without anyone travelling, and this is how the majority of engagements run.
The DHD, a pre-configured remote access device, ships to the site. Somebody on site plugs it into power and network, which takes minutes and needs no technical skill. It provides the access needed to examine the system properly, then ships back. Covers configuration, shipping both directions, and retrieval.
Cheaper and faster than travel for a single site, and it is what makes distance stop mattering. A site in another province costs the same to review as one an hour away.
For work that needs someone in the room: physical inspection, cabling and rack conditions, commissioning witness, or an environment that cannot be reached remotely. Travel and on-site time are added to the written quote before work starts.
What a health check does not include
Listed because an unstated exclusion is what turns an agreed scope into an argument at invoice time, and that is the exact failure this practice exists to review other people for.
- Remediation. The report says what to fix; fixing it is a separate engagement or your own team.
- Configuration changes. Nothing is altered on a live system during a review.
- Licence, hardware or software costs, which are yours and are bought direct.
- Vendor support cases, escalations, or dealings with your integrator on your behalf.
- On-site attendance, unless added explicitly.
- Ongoing monitoring or a retainer. A health check is a point-in-time assessment.
Looking at the whole site instead of one platform
A health check looks at one running platform. If the question is how the whole site compares with a standard, cameras, access control, credentials, and the network behind them, that is the physical security assessment and gap analysis.
Questions
What is a security system health check?
A structured, independent assessment of a running video or access control system: the servers, the database, the storage, the network, the hardening, and the lifecycle position. It ends in a findings report ranked by consequence and a remediation plan your integrator can price.
Which platforms do you cover?
Genetec Security Center, Milestone XProtect, Avigilon Unity and Alta, AXIS Camera Station, C-CURE 9000, Lenel OnGuard, and Kantech EntraPass. The engagement is the same shape on all 7, and the free Genetec checklist is a fair preview of the depth.
Does a health check change anything on my system?
No. Nothing is altered on a live system during a review. The report says what to fix, and fixing it is a separate engagement or your own team.
Can a health check be done remotely?
Yes. Most of what a health check examines is visible without anyone travelling, through a screen share and supplied configuration exports, logs, and documentation. For sites that cannot be reached over the network, the DHD, a remote access device, ships to site.
How is a health check different from a physical security assessment?
A health check looks at one running platform. If the question is how the whole site compares with a standard, covering cameras, access control, credentials, and the network behind them, that is the physical security assessment.
How much does a health check cost?
Platform, approximate camera and door count, and how many sites is enough to scope it. A written quote comes before any work starts.
Tell me which platform and how big
Platform, approximate camera and door count, and how many sites. That is enough to scope it.