A small system is cameras, a Network Video Recorder (NVR), storage, a network path, and a viewing method. Cameras usually take Power over Ethernet (PoE) from the recorder or a PoE switch — one cable for data and power. Storage sizing follows resolution, frame rate, compression, number of cameras and retention days; get the retention requirement from the owner (and from any regulation) before you buy disks.
Segment the cameras. They belong on their own VLAN (Virtual Local Area Network) with no route to the business network and no outbound internet access unless the vendor's cloud service requires it. Cameras are notorious for old firmware and hardcoded accounts; treat them as untrusted devices sitting inside the building.
Change every default credential, create per-person viewing accounts rather than one shared admin login, and keep firmware current — that is where the published vulnerabilities live. Record what firmware version each device runs and when you last checked.
Placement decides value: entrances, point-of-sale, stock rooms, rear doors. Avoid pointing cameras where they capture areas with an expectation of privacy — treatment rooms, bathrooms, changing areas. Check local law and the client's obligations; that conversation is part of the job, not an add-on.