Never port-forward an NVR to the internet. That single habit puts thousands of recorders on public scanning lists. Use the vendor's authenticated cloud relay with MFA (Multi-Factor Authentication) if it exists and is reputable, or a VPN (Virtual Private Network) into the business network. If a previous installer left a port forward, closing it and moving to a VPN is often the highest-value hour you will spend at that client.
Access control — keypads, fobs, smart locks, video doorbells — is identity for the physical world. Each person gets their own code or credential; codes are revoked at offboarding; a shared code known by everyone since 2019 is the physical equivalent of a shared password.
Integrate the systems with the joiner-mover-leaver process. The offboarding checklist should include door credential revocation and camera-system account removal alongside the Microsoft 365 steps. This is exactly where small businesses forget, and where an incident becomes embarrassing.
Document the physical layer: device locations, IP (Internet Protocol) addresses, credentials in the password manager, retention settings, who may view footage, and the procedure for handing footage to an insurer or law enforcement. Decide that procedure calmly, in advance.