The pattern shows up at the spoke sites
The HQ pilot lands clean. The spoke sites are where the cracks open: a network closet untouched since 2014, an ISP good enough for retail POS but not for cloud video, a site manager who wasn't on the kickoff call. The seven mistakes below all sit at the spokes, surface 30 to 90 days post-cutover, and cost hours to fix pre-cutover and weeks after.
1. Network not ready at the spoke sites
PoE budget, uplink quality, VLAN segmentation. The closet switch at the small remote location can't power the new cameras; the uplink is good enough for retail POS but not for cloud VMS streaming during incident review; the cameras land on the corporate VLAN and become an attack surface. The audit checks the budget at every closet, runs an upload test at peak hours, and confirms VLAN segmentation per site.
2. Vendor lock-in baked into the central VMS
Closed ecosystems work when you're moving the whole portfolio at once. Camera-agnostic platforms work when you have a mixed fleet you can't replace in one cycle. The mistake is committing to closed when the budget can't cover a full-portfolio replacement in year one.
3. Retention defaults set too short
Most cloud VMS ships at 30 days. PCI-DSS sites need 90. NDAA grant-funded sites match the grant requirement. Healthcare and education cluster at 30 to 90 by policy. Set the floor per site before cutover. Catching a retention gap 60 days later, after a claim has already aged out the footage, is not a real fix.
4. No documented chain-of-custody workflow
The export shows up on a USB drive with no metadata, defense counsel argues the file could have been altered, and the judge agrees. Modern cloud VMS handles hashing and access logs automatically; legacy NVRs need a documented manual process. Either way, the workflow needs to exist before cutover, with a named operator who runs it.
5. No rollback plan when a site fails commissioning
Sometimes the camera fleet boots, sometimes it doesn't. Lightning at one site, an ISP outage at another, a closet switch that only had 60 watts of PoE budget after all. The rollback plan keeps the legacy system running until the new one is fully verified. Without it, the site is dark for the days the rescue takes.
6. No on-site training for the operators
The buyer signs the contract; the operations manager and loss-prevention team open the dashboard Monday. If they haven't been trained, the system gets used at 10 percent of capacity. A 90-minute on-site session per region plus a recorded reference for the next hire is the minimum.
7. No change-management plan
Cameras are visible to staff and customers in a way most security upgrades aren't. Posting signage, briefing the front-line manager, and giving the privacy or HR team a written summary are part of the rollout. Skipping the briefing turns a security upgrade into a labor-relations issue at one or two sites every time.
The pre-cutover audit, what we actually do
- Site-by-site network readiness: PoE budget, uplink test at peak, VLAN segmentation.
- VMS architecture review: closed ecosystem versus camera-agnostic, keyed to the actual fleet inventory.
- Retention floor per site by regulatory regime (PCI-DSS, NDAA, HIPAA, FERPA).
- Chain-of-custody workflow with named operators per region.
- Rollback plan: legacy system stays live until new system is fully verified.
- Training plan: on-site sessions per region, recorded reference for the next hire.
- Change-management plan: signage, front-line manager briefing, privacy and HR summary.
We work multi-vendor across IP cameras, access control, and video management systems from major manufacturers, plus camera-agnostic analytics that run on equipment you already own. The free consultation produces the readiness gap list and the cutover plan in writing.