How to integrate AV systems with building security
Where audio and video should connect to cameras, intercoms and access control, where they should stay apart, and how to keep one network from becoming a way into the other.
Technical figures checked against the standards listed at the end.
To integrate AV systems with building security, connect them only where one system needs something from the other: camera views on the lobby and desk screens, the door intercom announcing visitors over the paging speakers, and door schedules that match the rooms people book. Keep them apart everywhere else, with AV and security devices on separate VLANs and a firewall that allows only those few flows by name. Paging and music are not a fire alarm system, so any link to the fire alarm is designed with the fire alarm contractor.
Swipe the drawing sideways to see the whole building.
Camera views on lobby and desk screens
Integrate, view only
- What passes between them
- Video, one way: HDMI from the recorder, or a view-only network stream to a decoder.
- Direction
- Security to AV
The desk monitor takes a grid straight from the recorder's HDMI output, so it never touches the AV network. The public view monitor by the street door shows the entrance camera only. Any screen that pulls a stream over the network gets a view-only account on the recorder and one firewall rule.
Watch forA screen logged in to the recorder with an admin account, or a public screen showing cameras the street should not see.
Every figure uses the same building: a nine-story office building in Midtown with a staffed lobby desk, a street door with a door station, a shared conference center on floor 2, tenant suites on floors 3 to 9, and the main telecom room in the cellar with a riser to each floor. It has cameras, access control, an IP intercom, lobby screens, background music and paging. It is an example, not a client's building.
01How to integrate AV systems with building security: where they meet
Audio and video and security used to be separate trades on separate cable: coax to a DVR, HDMI to a projector. Today both run on Cat6 and on the building network, so they share pathways, closets and switches whether anyone planned it or not. That makes integration easy to do and easy to overdo. Figure 1 walks the example building and shows the five places the two systems meet, including the one where they must not.
Camera views on lobby and desk screens
This is the most common request. The desk wants a grid of the building's cameras, and the lobby may want a public view monitor at the door showing the entrance camera, which tells everyone coming in that they are on camera. A desk monitor is best fed straight from the recorder's HDMI output: no network link and nothing to set up on the AV side. A screen farther away, or a camera tile inside a signage layout, uses a network decoder or the signage player, and that takes a view-only account on the recorder and one firewall rule. Our guide to NVR, DVR and cloud recording covers the recorder itself, including its HDMI outputs.
Intercom calls and paging
An IP door station can place a SIP call, the same signaling an office phone system uses, to the paging system. A visitor at the loading door is announced in the back office, and the desk can page the lobby from a microphone or a phone. While the page plays, the background music in that zone ducks, then comes back. Older systems do the same job with a relay contact into the amplifier. Paging and music are not a fire alarm or mass notification system, and a page is not an emergency signal. Our intercom installation page covers door stations.
Conference rooms and door schedules
The access control system unlocks doors on schedules. The conference room panels show bookings from the calendar. In a shared conference center the two have to agree: a room bookable until 8 PM behind a door that locks at 6 PM is a call to the desk every evening. Most buildings set the door schedule to match the hours the rooms can be booked and stop there. Some platforms can unlock a door for each booking, but that hands a door to whoever can book a room, so decide who books before you connect them. Our article on how access control works explains schedules and controllers.
Digital signage
A signage player shows the directory, building notices and welcome messages on a schedule, and it pulls its content from the internet or a content server. It needs nothing from the security system. That is the reason to list it: signage is the device most likely to be plugged into whatever network port is free, and the one that should have no route at all to a recorder or a door controller.
The fire alarm is a boundary, not a touchpoint
Fire alarm systems, including voice evacuation and mass notification, are life safety systems covered by NFPA 72 and the building's own requirements. When an alarm needs to mute the music and paging, or release door locks where the building's requirements call for it, that connection is designed, installed and tested with the fire alarm contractor. We pick the lock for each door around its use and the building's fire and life safety requirements.
02How AV and security systems connect: four kinds of link
Every touchpoint in Figure 1 uses one of four links. They differ in what can go wrong, so pick the simplest one that does the job.
| Link | What it carries | Good for | What it costs you |
|---|---|---|---|
| Video output (HDMI from the recorder) | Live views, one way | A desk monitor or a public view monitor near the recorder | Distance. Passive HDMI is reliable for a few meters; longer runs use HDBaseT over one Cat6 run, up to 100 m, or active optical HDMI cable. |
| Network stream (decoder or signage player) | One or more camera streams over the network | A screen far from the recorder, a camera tile inside a signage layout | An account on the recorder and a firewall rule. Make it view-only and limit it to the streams it needs. |
| SIP call or relay contact | A call, or an on and off signal | Door station to paging, a door alarm to a chime at the desk | Very little. A relay is simple, and easy to test and to document. |
| Software integration | Events, schedules and commands | Booking-driven door unlocks, events from both systems on one screen | Two vendors and two update cycles, and a link that can stop working quietly when either side updates. |
A useful rule: information should flow from security to AV, not the other way. A screen that shows video cannot change what the recorder does. A room system that can command a door controller is a new way into the building. Where a link has to go the other way, as with a booking that unlocks a door, make it a deliberate decision with an owner, not a side effect of the AV programming.
03Network separation: VLANs for AV and security systems
Putting AV and security on one network is cheaper on day one: one set of switches, one set of addresses, nothing to configure. It is the wrong saving. Figure 2 shows the example building's network both ways.
Swipe the drawing sideways to see every device.
Signage to recorder: Allowed by one rule
Rule: the signage player may pull one view-only stream from the recorder. Everything else from VLAN 30 to VLAN 10 is denied.
- Camera to recorderWorks, same VLAN
- Signage to recorderAllowed by one rule
- Door station to pagingAllowed by one rule
- Guest laptop to recorderBlocked
- Room system to door controllerBlocked
- AV video streamStays with its decoder
What goes wrong on a flat network
Three things. First, reach: a guest on the Wi-Fi or a compromised room PC can open the recorder's and the door controller's login pages, and only a password stands in the way. Second, traffic: AV over IP video is often sent as multicast, and a switch without IGMP snooping copies multicast to every port, so cameras, the recorder and the door controller all receive a video stream they never asked for. Third, ownership: the AV integrator, the IT team and the security installer all change settings on the same switches, and nobody owns the result.
What separation looks like
A VLAN (virtual LAN, defined in IEEE 802.1Q) splits one physical switch into several networks that cannot reach each other without going through a router. Give each system its own: cameras and the recorder; access control and the intercom; AV, including displays, signage, room systems and paging; and guest Wi-Fi. The firewall between them denies everything by default, and each flow that should cross gets its own rule: the signage player may pull one view-only stream from the recorder, and the door station may call the paging system. Write each rule down with the reason for it, so the next person to touch the firewall knows why it is there.
Turn on IGMP snooping on the AV VLAN so multicast video goes only to the decoders that joined the stream. Keep the PoE budget in mind as well: cameras, door stations, room panels and PoE ceiling speakers on one switch all draw from the same budget. Our technical guide to PoE camera installation works through it.
VLANs or separate switches
VLANs on shared switches work well when one team administers the network. Separate physical switches make sense when different parties own the systems: a landlord's security system and a tenant's AV, for example, or a building that does not want its cameras to depend on a switch the AV integrator manages. We work with your IT team or managed service provider on VLANs, PoE port assignments and firewall rules, so AV devices do not become a way into the security system. Our networking page covers that work, and our article on securing security cameras from hackers covers the camera side in more depth.
04A lobby that does both: screens, cameras and paging
The lobby is where the two systems share a room. Figure 3 is the example building's lobby in plan, with three screens, four cameras and four speaker zones. Pick a screen to see who can see it and what feeds it.
Swipe the plan sideways to see the whole lobby.
Public view monitor
Entrance camera only
- Shows
- The entrance camera, live.
- Who can see or hear it
- Everyone coming in the door. That is its job: it tells visitors they are on camera.
- Fed from
- An HDMI output on the recorder, or a decoder with a view-only stream.
- Keep off it
- Every other camera. The mailroom, the elevators and the desk area are not for the street.
Three screens, three audiences
Each screen has an audience, and the audience decides what it may show. The public view monitor faces people coming in and shows the entrance camera only. The desk monitor faces the staff and shows the grid. The signage display faces the whole lobby and shows no cameras beyond what the public view already shows. The mistake to avoid is the last button in Figure 3: every camera on the screen by the door. It tells anyone in the vestibule when the desk is empty, where the packages are and who is waiting at the elevators.
Music, paging and the door
Background music runs in zones, each on its own amplifier channel with its own volume. The desk pages one zone or all of them; the music ducks in the paged zones and comes back after. If the door station is set to announce after-hours deliveries, the same paging path carries it. Commercial paging of this kind usually runs as a 70 V line, where one amplifier drives many speakers and a transformer tap on each sets its level. Background music in a business is a public performance and needs licensing, and many commercial music services include it. That is general information, not legal advice.
Displays that run all day
A lobby or desk screen runs all day, every day. Commercial displays are rated for long daily hours, many for 24/7 use, and come with commercial warranties; consumer TVs are not meant for all-day use. A screen that faces a street window needs a high-brightness display, commonly 2,500 nits or more, where a typical indoor display is a few hundred nits. Our lobby audio and video page covers lobby screens and music in more detail.
05Showing security cameras on a lobby or desk monitor: how many tiles?
Splitting one screen into more tiles shows more cameras and less of each. Figure 4 works it out for a real screen size, screen resolution, camera and viewing distance.
55 in screen: 47.9 × 27.0 in, split 3 × 3
1080p screen 1,920 × 1,080 ÷ 3 each way
230,400 of the 3,686,400 pixels in a 4MP image (2,560 × 1,440)
4 × 9.0 in = 3 ft; general content to 4 ft 6 in (6 ×); video only to 6 ft (8 ×)
9 cameras on a 55 in 1080p screen. At 2.5 ft, a seat at the desk, each tile is close enough to read detail, such as a face at the door.
The math, worked once
A 16:9 screen is 0.49 × its diagonal tall and 0.872 × its diagonal wide, so a 55 in screen is 27 in tall and 47.9 in wide. In a 3 × 3 grid, each tile is a third of each: 16 in wide and 9 in tall, and on a 1080p screen, 640 × 360 pixels. A 4MP camera image is 2560 × 1440, about 3.7 million pixels. The tile shows 230,400 of them, about 6 percent.
tile height = 55 × 0.49 ÷ 3 = 9.0 in
pixels shown = (640 × 360) ÷ (2560 × 1440) = 6.25%
detail distance = 4 × 9.0 in = 36 in, about 3 ft
For distance, the classic 4-6-8 rule of thumb, applied to each tile as its own image, puts the farthest viewer for detail at about 4 × the image height, for general content 6 ×, and for video only 8 ×. A 9 in tile reads detail to about 3 ft, which is a seat at the desk. A 16 camera grid on the same screen has 6.7 in tiles that hold detail only to about 2 ft 3 in. The rule is a rule of thumb; AVIXA's DISCAS standard is the current method for sizing displays.
What the tile throws away, the recording keeps. The recorder stores each camera's full stream whatever the monitor shows, and many recorders build their grid views from each camera's lower-resolution sub stream. To check a face or a plate, open the camera full screen or play it back. Our guide to how far a security camera can see covers the pixels the camera itself needs at a distance.
06Cameras with speakers and microphones
Many IP cameras and door stations have a speaker and a microphone, so the desk can talk to someone at a rear door or a loading dock without walking over. Two-way talk is a useful link between the security side and the audio side, and it needs nothing more than the camera's own audio and the recorder or app that already runs it.
Recording audio is a different question from recording video. New York's Penal Law defines mechanical overhearing of a conversation as intentionally overhearing or recording a conversation without the consent of at least one party to it, by a person not present, and makes eavesdropping a crime. A camera that records conversations in a lobby can fall under that, and a sign on the wall does not by itself settle it. Treat audio recording as a question for your attorney before anyone switches it on. This is general information, not legal advice; our guide to NYC building security rules covers what the law says about cameras in buildings.
07Plan AV and security in one scope
The biggest saving from integration is not a feature; it is the cable plant. Both systems run on Cat6, both end in the same telecom rooms, and both need the same ceiling access. Planned together, they share one set of pathways, one riser, one rack plan and one labeling scheme, with one low-voltage contractor managing the installation instead of two crews pulling cable past each other.
- Cable. Cat6 for network devices, rated CMP in air-handling plenum ceilings and CMR in risers; HDMI and speaker cable in walls rated CL2 or CL3; HDBaseT over Cat6, up to 100 m, where a display sits far from its source. Our comparison of Cat5e, Cat6 and Cat6A covers which to run.
- Rack and power. Rack space and a PoE budget for both systems, a UPS for the recorder and the switches, and power for the rack coordinated with the electrician. Our article on what keeps recording in a power outage sizes the UPS.
- Penetrations. Every penetration we make through a fire-rated wall or floor is fire-stopped.
- Documents. A device list with IP addresses and VLANs, the firewall rules with the reason for each, which screen shows which cameras, the admin accounts handed over to you, and who to call for each system.
Who manages what
Integrated systems still need owners. When the desk monitor goes dark, the documents should say whether that is a recorder output or a display problem, and who to call. A split that works in most buildings:
| Device or setting | System | Usually managed by |
|---|---|---|
| Cameras, recorder, desk and public view monitors | Security | Building security or property management |
| Door station, readers, door schedules | Access control and intercom | Building security or property management |
| Signage, room systems, music and paging | AV | Facilities, or the tenant for its own rooms |
| VLANs, firewall rules, switch ports | Network | IT or the managed service provider |
| Fire alarm and its connections | Life safety | The fire alarm contractor |
For the security side of the same building, our guides to combining cameras with access control and connecting a video intercom to cloud access control go further. A written low-voltage scope of work is where all of this gets pinned down. Our audio and video installation and commercial AV pages cover the AV work, and our security camera, access control and structured cabling pages cover the rest.
08Questions to ask before you integrate
- Which screens will show cameras, who can see each one, and which cameras go on each?
- Is each screen fed by HDMI from the recorder or by a network stream, and if a stream, which account does it use?
- Which VLAN is each device on, and which flows cross between them, with a written reason for each?
- Is IGMP snooping turned on wherever AV video is sent as multicast?
- What triggers the paging system from the intercom: a SIP call or a relay contact?
- Does anything connect to the fire alarm, and has the fire alarm contractor designed that connection?
- Is audio recording turned off on every camera, unless your attorney has said otherwise?
- Who holds the admin accounts for the recorder, the access control, the AV control and the network at handoff?
- When a lobby screen goes dark, who do you call?
09AV and security integration: FAQ
Can security cameras be shown on a lobby TV?
Yes. A desk monitor is usually fed straight from the recorder's HDMI output, and a public view monitor by the door shows the entrance camera only. Use a commercial display rated for all-day use, and keep the mailroom, elevator and desk cameras off any screen the public can see.
Should AV and security systems be on the same network?
They can share cable and even switches, but not one flat network. Put each system on its own VLAN, deny traffic between them by default, and allow only the flows that need to cross, such as one view-only camera stream to a signage player or a door station call to the paging system.
Can a paging system be connected to the intercom?
Yes. An IP door station can place a SIP call to the paging system, and older systems use a relay contact into the amplifier. The music in the paged zone ducks during the announcement and comes back after.
Can the paging or music system be used for emergency announcements?
No. Paging and music are not a fire alarm or mass notification system; those are life safety systems covered by NFPA 72 and the building's own requirements. If the fire alarm needs to mute the music during an alarm, that connection is designed with the fire alarm contractor.
Can a conference room booking unlock a door?
Some access control and room booking platforms can be linked so a booking unlocks a door for its time slot. Most buildings simply set the door schedule to match the hours the rooms can be booked. A direct link puts the calendar in charge of a door, so decide who can book before connecting them.
How many cameras can a lobby monitor show at once?
As many as the recorder allows, but each tile gets smaller. On a 55 in 1080p screen, a 9 camera grid gives tiles 9 in tall and 640 × 360 pixels, enough for detail to about 3 ft. At 16 cameras the tiles are 6.7 in tall and hold detail only to about 2 ft 3 in.
Sources and standards
- IEEE 802.1QBridges and bridged networks: the standard that defines VLANs and VLAN tagging on Ethernet switches.
- IETF RFC 4541Considerations for IGMP and MLD snooping switches: a snooping switch forwards multicast only to ports with listeners; without snooping, multicast is flooded like broadcast.
- IETF RFC 3261SIP, the Session Initiation Protocol: the call signaling used by IP intercoms, phones and IP paging.
- NFPA 72, Chapter 24National Fire Alarm and Signaling Code, Emergency Communications Systems: in-building fire emergency voice and alarm communication systems and mass notification systems.
- New York Penal Law 250.00 and 250.05Definitions of wiretapping and mechanical overhearing of a conversation (without the consent of at least one party, by a person not present), and the eavesdropping offense. Cited as general information, not legal advice.
- AVIXA DISCASDisplay Image Size for 2D Content in Audiovisual Systems, the current method for display sizing. The 4-6-8 rule used in Figure 4 is the older rule of thumb.
- HDBaseT specificationVideo, audio, control and often power over one Cat6 or Cat6A run up to 100 m (328 ft).
- NFPA 70 (NEC) cable listingsCMP and CMR communications cable for plenum and riser spaces; CL2 and CL3 power-limited cable for HDMI and speaker runs in walls.
Planning AV and security together?
Send us the floor plan or a few photos of the lobby and the telecom room. We can look at both systems on one site visit and put them in one written scope. Same-day quotes when we can. Licensed and insured.