Back to Learn
Buyer's guide

Site security planning for NYC and NJ commercial properties: what every system needs

How to plan cameras, access control, intercoms and cabling for a commercial building before anyone prices equipment, worked through one example building from the cellar to the roof.

By Seneca Security Published May 3, 2026 · Updated November 5, 2026 15 min read

Technical figures checked against the standards listed at the end.

Fig 1The site walk

Swipe the drawing sideways to see the whole building.

Section through the example building, a six-story pre-war mixed-use building 100 feet deep, cut through the lobby. Perimeter: the lobby door, the steel sidewalk doors into the cellar, the rear service door to the alley and the roof door on the stair bulkhead are marked, with camera views of the sidewalk and the alley. Entries: devices appear at each door. Interior paths: the stair from cellar to roof and the elevator are traced. Risers and closets: the carrier demarc at the front of the cellar, the riser at the rear beside the stair, a closet spot by the riser and an optional closet on floor 4. STREET ALLEY BOILER FL 1 FL 2 FL 3 FL 4 FL 5 FL 6 CELLAR ROOF LOBBY OFFICES OFFICES OFFICES OFFICES ELEV STAIR LOBBY DOOR SIDEWALK DOORS SERVICEDOOR ROOF DOOR CALL STATION, READER READER, CONTACT CONTACT SHOP BACK DOOR? SUITE 3 ELEVATOR: FLOORS BY GROUP ONE STAIR, CELLAR TO ROOF DEMARC CLOSET SPOT FL 4 OPTION RISER
Scope list6 items

Pass 1. Walk the sidewalk, the alley and the roof. Every way in counts, including the doors nobody uses.

  1. 1Perimeter
  2. Lobby door, street side
  3. Shop storefront, the shop's own
  4. Sidewalk doors into the cellar
  5. Rear service door to the alley
  6. Roof door on the stair bulkhead
  7. Camera views: sidewalk, alley
  8. 2Entries
  9. Lobby: call station, reader, strike
  10. Service door: reader, contact, cameras
  11. Roof door: contact; lock set by life safety
  12. Shop back door: who controls it?
  13. 3Interior paths
  14. Stair: cellar to roof, floor re-entry
  15. Elevator: cab reader and camera
  16. Floors 2 to 6: suite doors, landings
  17. 4Risers and closets
  18. Demarc at the front of the cellar
  19. Riser at the rear, by the stair
  20. Closet spot by the riser, with power
  21. Option: second closet on floor 4
Example building: six stories, pre-war, 50 ft wide and 100 ft deep, cut through the lobby and drawn to scale. Each pass adds to the scope list, which becomes the written scope once every item is marked on a plan.

A site security plan for a commercial building is a written scope that puts every camera, card reader, lock, intercom station and network closet at a location, with the cable path between them and the rules for who can open which door and when. It comes from walking the building before anyone prices equipment, and it covers six parts: the site walk, cameras and video storage, access control, intercoms, structured cabling, and how the systems work together. This guide works through each part on one example building, with arithmetic you can check.

Buildings in New York City and northern New Jersey add conditions of their own: older construction with few open paths for cable, several tenants behind one street door, cellars that open onto the sidewalk, and closets never meant for network equipment. Most projects still start with a number, such as sixteen cameras and a reader on the front door. That number is a guess until someone has walked the building.

The example building

Every figure shows the same building: a six-story pre-war mixed-use building in Brooklyn, 50 ft wide and 100 ft deep. A shop has the ground floor; offices fill floors 2 to 6. People enter through a street lobby door, and deliveries use a rear service door to an alley. One stair runs from the cellar to the roof, and there is one elevator. The carriers bring service into the cellar. It is an example, not a client's building.

01How to start a site security plan: walk the building first

Walk the building in four passes, the same four as Figure 1.

Perimeter

Count every way in from outside, including the ones nobody uses. The example building has five: the lobby door, the shop's storefront, the rear service door, the roof door and the steel sidewalk doors into the cellar. The last two are the ones most often left off a scope, because nobody uses them on an ordinary day.

Entries

For each door, write down its use, who goes through it and when, and what hardware is on it now. The lobby door needs a call station and a reader. The service door is open to deliveries by day and should be locked and watched at night. The roof door is part of the stair, so how it locks depends on the building's fire and life safety requirements; at a minimum it should report when it opens. A shop's back door into the building corridor joins two tenants, and someone has to decide who controls it.

Interior paths

The stair connects every floor, so a locked suite door does little if anyone can climb the stair and walk through an unlocked floor door. The elevator is where most access rules will live: which floors each group of people can reach.

Risers and closets

Find the demarc, where the carriers bring service in; here it is at the front of the cellar. Then find the riser, the vertical path you can actually use between floors; here it is at the rear, beside the stair. Look for a dry spot near the riser with power and room for a wall rack. Those two spots set every cable length, as Figure 6 shows.

The walk produces a written scope: a list and a marked-up plan that put every device and closet at a location, with the cable path between them. If a proposal arrives without one, ask for it before you compare prices. Our article on what a low-voltage scope of work should cover for a NYC commercial security installation goes through it line by line.

02Commercial building security cameras: pixels per foot and storage

Give each camera a job in one line: identify a face at the lobby door, see a person in the alley. The job decides the camera, the lens and the mounting spot, and the count follows from the jobs. Our guide to how many cameras a business actually needs covers common layouts.

The measure that matters is pixel density: horizontal pixels per foot of scene at the person's distance. IEC 62676-4 gives reference densities for four tasks: 250 pixels per meter to identify a person (about 76 per foot), 125 to recognize someone you know (38), 62 to observe what they are doing (19) and 25 to detect that someone is there (8).

Scene width at distance d is 2 × d × tan(half the horizontal field of view); divide the camera's horizontal pixels by it. A 4MP camera is 2560 pixels wide. With an 80 degree lens, the scene 20 ft away is 33.6 ft wide: 76.3 pixels per foot, right at the identify line. At 40 ft the same camera gives 38.1, which only recognizes. A 4K camera with a 100 degree lens gives 40.3 at 40 ft, barely more.

Fig 2Pixels on a face
Resolution
Lens

Swipe the drawing sideways to follow the person out the door.

Plan of the example lobby to scale: 14 feet wide, with the camera on the back wall by the elevator aimed at the street door 40 feet away, and the sidewalk beyond. The field of view and the floor bands for Identify, Recognize, Observe and Detect change with the resolution and lens chosen. A person walks from the camera out to the sidewalk; the computed pixels per foot at their distance are shown beside the drawing. SHOP (BEHIND THE LOBBY WALL) NEIGHBORING BUILDING SIDEWALK STREET STREET DOOR ELEVATOR WALL CAMERA 0 FT 10 FT 20 FT 30 FT 40 FT 50 FT 60 FT
Distance
152.5pixels per foot at 10 ft Identify · 500 px/m
Camera and lens4MP (2,560 px), 80°
Scene width at 10 ft16.8 ft
Identifies faces out to20.0 ft

2,560 px ÷ (2 × 10 ft × tan 40°) = 2,560 ÷ 16.8 = 152.5 px/ft

Identify 250 px/mRecognize 125Observe 62Detect 25
Lobby plan to scale, camera 40 ft from the street door; walls block the view except through the glass door. Example: a 4MP camera with an 80 degree lens gives 76.3 px/ft at 20 ft (Identify) and 38.1 px/ft at 40 ft (Recognize). Floor bands use the IEC 62676-4 densities. These are best cases: real images also depend on lighting, compression and focus. Our full calculator covers more cameras and lenses.

In Figure 2, the narrow lens identifies people all the way out the door, but 10 ft from the camera it sees a strip only 7.3 ft wide, and a person can pass along the wall unseen. The wide lens covers the room but identifies no one past about 14 ft at 4MP. That is why a lobby door usually gets two cameras: one aimed at the door at short range for faces, and one wide view of the room. To try other cameras, lenses and distances, use the full calculator in our article on how far a security camera can see.

These are best cases. Lighting, compression, focus and the angle to the face all cost detail. The usual lobby problem is backlight from a glass street door at midday; a camera with good wide dynamic range helps, and so does a mounting spot that keeps the brightest glass out of frame.

Outside cameras face vibration from trucks and the subway, grime, weather and passersby who can reach a low mount. Mount them out of reach, in housings rated for outdoor use, and plan to clean them. In a landmarked building or historic district, exterior work may still need Landmarks Preservation Commission approval.

No single resolution suits every camera. Choose it per camera from the job and the distance; our security camera installation work starts from that list of jobs.

Size storage from retention, not the other way around

Retention is a policy decision: your own policy, your lease and your insurer set it, and no single number applies to every property. Storage then follows: megabits per second × 86,400 seconds ÷ 8 bits per byte ÷ 1,000 = gigabytes per camera per day. At 4 Mbps that is 43.2 GB. The example building's 14 cameras kept 30 days need 14 × 30 × 43.2 = 18,144 GB, about 18.1 TB before redundancy.

Bitrate is the number to question. It depends on resolution, frame rate, codec and how busy the scene is; a lobby at 9 AM makes far more data than an empty corridor at night. Ask what bitrate an installer assumed. If you record off site, it also sets your upload: 14 cameras at 4 Mbps is a steady 56 Mbps. Our article on how long security camera recordings last goes further into retention.

Fig 3What retention costs in storage
Cameras
Days kept
Example bitrate
Per camera per day43.2 GB

4 Mbps × 86,400 s ÷ 8 ÷ 1,000 = 43.2 GB

Total18,144 GB

43.2 GB × 14 cameras × 30 days = 18,144 GB

Upload if recorded off site56 Mbps steady
18.1TB raw

3 drives of 8 TB, raw. Redundancy and the recorder's own reserve add more.

Bitrates are examples; actual bitrate depends on resolution, frame rate, codec and how busy the scene is. Each tile is an 8 TB drive, before redundancy. Example building: 14 cameras × 30 days × 43.2 GB = 18,144 GB, about 18.1 TB.

Put the recorder and the PoE switch on a UPS so a short outage does not stop recording, and keep the recorder in a locked closet, not under the front desk.

03Access control for a commercial building: layers, schedules and locks

Access control is a set of rules about who can open which door and when, enforced by readers, locks and a controller and recorded every time. Think in layers: perimeter doors, the core with the elevator and stair, tenant and service spaces, and inner rooms. A person gets a credential only for the layers their work needs.

Figure 4 runs five people through the example building. An office tenant on floor 3 gets the street door at any hour, the elevator to floor 3 and the suite door. The cleaning crew gets the street and service doors, the elevator and the suites from 8 PM to midnight. The shop gets the service door and its own back door. The super gets the building's spaces but not the tenants' suites.

Fig 4Layers of entry
The example building as four rings of entry: the perimeter doors, the core with the elevator and stair, the tenant and service spaces, and the inner rooms. Each door is a dot on its ring. Picking a person lights the doors that person can open at the time shown and traces their path inward. For a former employee every door turns red at once. 1 PERIMETER2 CORE3 SPACES4 INNER STREET DOOR SERVICE DOOR ROOF DOOR ELEVATOR STAIR DOOR FL 1 CORRIDOR SUITE 3 CELLAR DOOR SHOP BACK DOOR IT ROOM CLOSET
Office tenantStaff of the floor 3 tenant, shown at 2 PM
Street doorAny time
ElevatorFloor 3 only
Suite 3 doorAny time
IT roomNo, the tenant's IT lead only
Service door, cellar, roofNo

The managing agent grants the street door and elevator. The tenant manages its own suite and staff.

Two common locks, seen from inside Two doors seen from inside. Left: an electric strike in the frame releases the latch; the lever handle always opens the door from inside. Right: a magnetic lock on the header holds the door; an exit sensor above the door and a push button beside it cut its power so people can always get out, with fire alarm release where the building's requirements call for it. STRIKE IN THE FRAMEThe handle alwayslets people out. HELD BYTHE MAGNET MAGNET ON THE HEADERExit sensor and pushbutton free the door.
Green doors open for that person at the time shown. Rings are drawn by depth into the building, not to scale. Office tenant: street door, elevator to floor 3, Suite 3. Cleaning crew: street door, service door, elevator and suites from 8 PM to midnight.

When someone leaves, the credential is removed once and every online reader refuses it from that moment, with no keys to collect. Battery locks not wired to the network update on their next sync, so ask how often that happens.

With several tenants, decide who administers what. The managing agent usually controls the street door, elevator, service door and closets; each tenant may manage its own suite and staff. Set the system up so a tenant's administrator cannot see or change anyone else's people.

The lock on each door

We pick the lock for each door around its use and the building's fire and life safety requirements. An electric strike in the frame releases the latch, and the inside handle keeps working, so people inside can always get out. A magnetic lock on the header holds the door with a magnet and has no handle of its own. A magnetic lock needs a free way out from inside at all times: usually an exit sensor that cuts power as someone walks up, a push button, and release from the fire alarm where the building's requirements call for it. Stair doors and doors on an exit path follow the building's own requirements, which we check on the site visit before any hardware is ordered.

The other early choice is where the system is managed: a cloud service in a browser, or a controller and software on site. Our guide to commercial access control system installation compares cloud management with an on-premise controller, and our access control services page shows how we plan doors.

04Intercom systems for the street door: where each call goes

Without a lobby attendant around the clock, the call station at the street door is how visitors and couriers get in, so plan where each call rings at each hour. In Figure 5, a call rings the front desk by day and the tenant's phone after hours. The person answering sees the visitor and presses unlock; the controller closes a relay, the lock power supply releases the strike, and the system logs who unlocked the door, when, with a snapshot.

Fig 5The street door call

Swipe the drawing sideways to follow the signal.

A visitor presses the call station at the lobby door. The call goes to the system, which routes it by schedule: to the front desk by day, to the tenant's phone after hours. The person answering sees the visitor and presses unlock. The access controller closes a relay, the lock power supply releases the strike, the door opens, and the event is logged with a snapshot. LOBBY STATIONCAMERA, MIC, BUTTON SCHEDULEROUTES THE CALL FRONT DESKBY DAY TENANT PHONEAFTER HOURS CONTROLLERRELAY LOCK POWER STRIKE AND DOOR 1 CALL2 ROUTE3 UNLOCK4 OPEN

A courier presses the button on the lobby station.

Event log
2:14 PMCall from lobby station
One call at the example building's lobby door, routed by schedule and logged with a snapshot.

Plan the directory with the tenants: one entry per company or per person, and what happens when nobody answers. Older buildings often have an analog intercom wired to every suite. Sometimes a new panel can reuse that wiring, and sometimes the old cable is too damaged or shared to trust. Test it before assuming either. Our intercom installation page covers video stations and phone apps for multi-tenant buildings.

05Structured cabling for security systems: closets, risers and the 90 m limit

Every device connects back to a closet over structured cabling, and copper Ethernet has a fixed length budget. Under ANSI/TIA-568 the permanent link from patch panel to outlet can be up to 90 m (295 ft), and patch cords add up to 10 m, for a 100 m channel. The limit is the same for Cat5e, Cat6 and Cat6A; a better category does not buy distance.

Figure 6 measures four runs three ways. With the main closet (MDF) at the demarc, every run crosses the cellar to the riser, climbs, and crosses its floor back toward the street; the run to the far front corner of floor 6 comes to about 96 m, over the limit. With the MDF on the riser side of the cellar, that run drops to about 70 m and every run fits. If that spot floods or runs hot, a second closet (IDF) on floor 4, fed by fiber up the riser, brings every upper floor run under 54 m.

Fig 6The riser and the 90 m limit

Swipe the drawing sideways to see the whole section.

Section of the example building with the demarc at the front of the cellar and the riser at the rear beside the stair. Three options: a main closet at the demarc, where the run to the far front corner of floor 6 is about 96 meters and over the limit; a main closet beside the riser, where the longest run is about 70 meters; and a second closet on floor 4 fed by fiber, where every upper floor run is under 54 meters. STREET ALLEY BOILER FL 1 FL 2 FL 3 FL 4 FL 5 FL 6 CELLAR ROOF LOBBY OFFICES OFFICES OFFICES OFFICES ELEV STAIR FIBER MDF MDF IDF DEMARC A B C D

The closet sits where the carriers come in. Every run crosses the cellar to the riser first, and the floor 6 corner run goes over the limit.

ALobby call stationfrom the MDF at the demarc68.7 m226 ftFits · past 55 m
BSuite 3 readerfrom the MDF at the demarc70.2 m230 ftFits · past 55 m
CFloor 6 corner camerafrom the MDF at the demarc95.9 m315 ftOver 90 m
DRoof door contactfrom the MDF at the demarc61.5 m202 ftFits · past 55 m

Each length is a permanent link: 6 ft at the rack, the path through the riser and ceiling, the drop to the device and 10 ft of service loops, plus 10 percent for routing around beams and ducts. Run C also crosses 30 ft of floor 6 to the far corner, which a section cannot show. All runs use the existing riser at the rear.

Same building, same section as Figure 1. Red runs exceed the 90 m permanent link. Longest runs: 95.9 m with the MDF at the demarc, 69.7 m with the MDF by the riser, 53.3 m on the upper floors with an IDF on floor 4.

Category matters for speed: Cat6 carries 10 Gb/s only to about 55 m, and Cat6A carries it the full 100 m. Cameras and readers need far less, so Cat6 serves them even on the 70 m run. Links between closets and to wireless access points are where Cat6A or fiber pays off. See how Cat5e, Cat6 and Cat6A compare.

The fire rating follows the space. Under the National Electrical Code, Article 800, a ceiling used as an air-handling plenum takes plenum cable (CMP), and a riser takes riser cable (CMR) at a minimum. Many pre-war buildings have both. Every penetration we make through a fire-rated wall or floor is fire-stopped.

Most cameras take power over the same cable (PoE). A switch has a total power budget as well as a per-port limit: up to 15.4 W per port under 802.3af and 30 W under 802.3at. Add the rated draw of every device, including heaters on outdoor cameras, and keep headroom. Readers and locks usually draw from the access controller and a lock power supply, with power coordinated with the electrician.

Whether a permit applies depends on the scope and the building. We check during the site visit and say what applies before work is scheduled. Our structured cabling page covers closets, risers, labeling and testing.

06Integrating cameras, access control and intercoms into one record

Integration means the systems share events, so one thing at a door produces one record. It does not require one manufacturer. It requires an access system, a recorder and call stations that exchange events, which you should confirm in writing before buying.

Figure 7 follows a forced rear service door at 11:42 PM. The door contact reports the door open with no card read and no exit request. The camera above the door bookmarks the clip. The management view shows one entry with the clip attached, and the on-call phone gets the same clip. In the morning nobody has to match a log time to a video timeline.

Fig 7One event, every system

Swipe the drawing sideways to follow the signal.

The rear service door at night. The door contact reports the door open with no card read and no exit request, so the access system marks it forced. The camera above the door bookmarks the clip. The management view shows one entry with the door, the time, the event type and the clip. The on-call phone gets a notification with the same clip. REAR SERVICE DOORALLEY SIDE, 11:42 PM CAMERACONTACT ACCESS CONTROLDOOR FORCED RECORDERCLIP BOOKMARKED ONE VIEW FORCEDSERVICE DOORCLIP ATTACHED ON CALL
1Access controlContact opens with no card read and no exit request. Event: door forced.
2RecorderThe camera above the door marks the clip, starting a few seconds before the door opened.
3Management viewOne entry: rear service door, 11:42 PM, forced, clip attached.
4NotificationThe on-call phone gets the alert with the same clip, not a bare alarm code.
One forced door at night becomes one entry with its video, and one notification.

Decide who gets notified, and for what. A forced door at night should reach someone; a door held open during noon deliveries should not, or people learn to ignore alerts.

Keep cameras and access equipment on their own network segment, apart from tenant and guest traffic. If you manage several properties, the same events can feed one view across sites; see remote video surveillance for businesses with multiple sites.

07Security system maintenance: what to check and how often

A system nobody checks fails quietly: drives fail, cameras drift or get knocked by a cart, and the credential list fills with people who left. Put these checks on a calendar, and write into the scope who does each one.

Monthly
  • Every camera shows live video and is recording.
  • The oldest footage on the recorder matches the retention you set.
Quarterly
  • Clean outdoor lenses and housings.
  • Test each reader, lock and door contact.
  • Check the credential list against current staff and tenants.
Yearly
  • Test the UPS under load.
  • Update firmware on cameras, recorder and controllers.
  • Review notification rules and who is on call.

The oldest-footage check catches a failed drive before you need the video.

08Questions to ask a security installer before you sign

Bring these to every walk-through and every proposal, including ours.

  1. Will you give us a written scope that shows every device and its location on a plan?
  2. For each locked door, how do people get out from inside, and what releases the lock?
  3. Which camera is meant to identify faces at each entry, and at what distance?
  4. What retention did you design for, what bitrate did you assume, and how much storage does that need?
  5. Where will the recorder live, and what keeps it and the PoE switch running in an outage?
  6. What cable rating will you use above each ceiling and in the riser?
  7. Which run is the longest, how long is it, and which closet serves it?
  8. Will every cable be labeled at both ends, with test results handed over?
  9. Who owns the admin accounts and passwords at handoff, and how are they handed over?
  10. When a credential is removed, how fast does every door refuse it, including battery locks?

Put the plan in writing

A good plan is short and specific: each device at a location, each door with its rule, each run with its length. Contact Seneca Security to set up a site visit, and we will walk the building with you and write that plan.

09Site security planning FAQ

What should a site security plan for a commercial building include?

It should include a written scope and a marked-up plan that put every camera, reader, lock, intercom station and closet at a location, with the cable path between them. It should also state the access rules for each door and group of people, the video retention and how the storage was sized, and who maintains each part. If a proposal does not show device locations, ask for them before you compare prices.

How many days of security camera footage should a commercial building keep?

There is no single required number. Your own policy, your lease and your insurer set it. Once you pick the number of days, storage follows from arithmetic: at 4 Mbps, one camera records 43.2 GB a day, so 14 cameras kept for 30 days need about 18.1 TB.

What camera resolution do I need to identify faces at a door?

It depends on the distance and the lens as much as the resolution. IEC 62676-4 gives 250 pixels per meter, about 76 pixels per foot, to identify a person. A 4MP camera with an 80 degree lens reaches that out to about 20 ft; farther away, use a narrower lens or a second camera closer to the door.

How long can an Ethernet cable run to a security camera be?

Under ANSI/TIA-568, the permanent link from the patch panel to the outlet can be up to 90 m, plus up to 10 m of patch cords, for a 100 m channel. The limit is the same for Cat5e, Cat6 and Cat6A. A run that would go longer needs a closet closer to the device, or fiber up the riser to a second closet.

Should every access controlled door have a magnetic lock?

No. We pick the lock for each door around its use and the building's fire and life safety requirements. An electric strike in the frame leaves the inside handle working, so people inside can always get out. A magnetic lock needs a free way out from inside at all times.

Do I need a permit to install security cameras or access control?

Whether a permit applies depends on the scope and the building. We check during the site visit and say what applies before work is scheduled. In a landmarked building or historic district, exterior work may still need Landmarks Preservation Commission approval.

Sources and standards

  • IEC 62676-4Video surveillance systems for use in security applications, Part 4: Application guidelines. Source of the pixel densities in Figure 2: Identify 250 px/m, Recognize 125, Observe 62, Detect 25.
  • ANSI/TIA-568 seriesCommercial building telecommunications cabling. Source of the 90 m permanent link and the 100 m channel in Figure 6.
  • TIA TSB-155 and IEEE 802.3an10GBASE-T over Category 6, limited to about 55 m, and over Category 6A to 100 m.
  • NFPA 70, National Electrical Code, Article 800Communications cable types, including plenum (CMP) and riser (CMR).
  • IEEE 802.3af and 802.3atPower over Ethernet: up to 15.4 W and 30 W per port at the switch.
Keep reading
CamerasBuilding Security Upgrades: How NYC Property Owners Can Combine Cameras and Access ControlHow door events and video work together, so each entry has a record you can check. Access controlCommercial Access Control System Installation in NYC: What to Expect from Start to FinishThe steps of an access control project, from the door survey to programming and handoff. Structured cablingHow Low-Voltage Cabling Infrastructure Supports Integrated Security in NYC Office BuildingsHow closets, risers and cable runs carry cameras, readers and intercoms in an office building.

Have a project in mind?

Send us the address and what you want to cover. We walk the building, then send a written scope. Same-day quotes when we can. Licensed and insured.

Get a Free Quote Call 212-347-5400 Text us a photo
Back to Learn