Is your CCTV system level B, E or H? How to rate it

Owners who open the NCSA CCTV guideline meet three letters early on: B, E and H. The questions follow at once. Which level is my system, and does a high level mean I fall into some legal category?

In short, the system owner assesses the level, following section 2.1 of the general book, and the result tells you how strict the controls should be. It says nothing about what the organisation is under the law. This article walks through section 2.1 piece by piece, from the reasons and the levels to the factors and the self-assessment form, and then rates an imagined coffee shop, factory and condominium.

For how the two NCSA books fit together and which to read, see our map of the NCSA guidelines. If you have never opened either, read that first and come back.

Why does the guideline split camera systems into three levels?

Because camera systems differ widely in purpose, data, connections and the harm a failure could cause. Section 2.1.1 says one set of controls for every system is a poor fit: too strict adds cost and may get in the way of use, too light leaves a system unable to prevent or withstand threats.

Section 2.1.2 therefore sets three levels and describes the system and impact at each. The table below rewords it.

A higher level does not always mean buying expensive kit. The guideline says so at the end of section 2.1.2.

A concrete case: level E differs from B in that some measures move from 'to be considered' to 'to be observed'. Multi-factor authentication for privileged accounts and remote access is one. Section 3.1 of the general book lists it as 'consider' at B and 'observe' at E and H. Moving up a level therefore often means being more systematic and keeping more evidence, not swapping cameras.

What factors decide the level of a system?

The impact and context of the system as a whole, rated on at least the four dimensions in section 2.1.3, not any single factor.

The common slip is to use the type of place as the answer: a small shop must be B, a hospital must be H. The guideline closes that door.

Beyond the four dimensions, section 2.1.3 has a second table of extra factors that may justify raising the level where appropriate. They are: cameras that connect to or support other critical systems or missions; exposure to the outside (internet-facing or remote access); providers, contractors or manufacturers who can reach the system; large volumes of data or links across systems; a history of incidents or relevant vulnerabilities; and specific requirements from law, a regulator or a contract.

The guideline sums up in one line: assess the impact of the system; do not grade from the name, type or size of the site.

How do you use the self-assessment in section 2.1.4?

Rate each dimension low, medium or high, then read the result with the interpretation rules under the table. The table below restates what each cell means.

The interpretation is three short rules. If the dimensions are mostly low, start from B. If one or more dimensions are medium, consider E. If an important dimension is high, especially safety of people, a critical mission or data impact, consider H.

Note the verb: 'consider'. This is a judgment guide, not a formula, and mid-range scores play no special role. The guideline also forbids using an average to talk a high rating down.

The last item in that sentence, recording the reasons, is worth doing at every level, because auditors and business partners ask why you chose it. A one-page record with the date, assessor, approver, the four ratings, the level chosen and the reasoning would answer them. The record format is our suggestion, not something in the guideline.

Who sets the level: the installer or the owner?

The owner. Section 2.1.5 gives the reason: the owner knows the purpose, the impact and the requirements that apply.

In practice, do not let a seller tell you 'level B is fine for a shop your size'. Have the installer ask you, before design, what level you assessed, and treat that level as a technical requirement. In a small business one person may hold several roles, but you should still be able to say who decides, who approves, who does the work, who checks and who is accountable when something goes wrong.

Which level would a coffee shop, a factory and a condominium get?

Every example below is invented, to show the reasoning behind the table in section 2.1.4. What changes the answer is the detail of the system, never the label on the business.

Hypothetical 1: a single-branch coffee shop

Suppose the shop has four cameras and a recorder behind the counter. The owner watches through a phone app that connects via the manufacturer's service. There is no microphone and no AI. The footage shows a few dozen customers a day, and if the cameras go down the shop can keep selling.

Mission, data and impact on attack probably sit in the low column. But watching from outside the shop fits the 'remote access' wording of the medium column under connectivity, so the rule 'one medium dimension, consider E' applies. In practice: start from the B set but treat remote access at the E standard, meaning change default credentials, turn on MFA if the app supports it, and do not expose ports directly to the internet. See our article on camera apps and P2P services.

Hypothetical 2: a metal-parts factory

Suppose the factory has 60 cameras. Eight of them watch a press and spots where workers are at risk, and the shift supervisor uses the live view to decide when to stop a machine. The video management system sits on the plant network, and a contractor maintains it remotely.

Mission looks high because the images relate to people's safety. Connectivity looks high because the system touches several others and outsiders have access. With an important dimension high, the guideline says consider H, and a low data rating cannot average it down. Now suppose the same factory's cameras only cover the gate and the warehouse, nobody uses them for safety decisions, and they are separated from the production network. The result drops to E or even B, which shows the word 'factory' alone tells you nothing.

Hypothetical 3: a 400-unit condominium

Suppose 120 cameras cover lifts, car park and corridors. A security company's control room watches live, the installer configures remotely, and a backup copy sits in the cloud. There is no AI, and the cameras are not linked to key cards or lifts.

Many residents appear and their comings and goings near their own doors are recorded, so data impact is medium. Connectivity is medium, with both remote access and the cloud. An attack would affect the building's security. The starting point is probably E. If the cameras are later connected to key-card access, or footage is used to decide who may enter an area, connectivity and impact could move to high and H would need to be considered.

Once the level is set, the next step is to pick controls from the tables in each section of the book. Every row shows 'to be observed' or 'to be considered' separately for B, E and H. Where one part of a system matters more than the rest, such as cameras at machinery, section 1.2 says to consider controls for each component by its role in the system and the level of the system overall.

Are levels B, E and H the same as a CII classification or a legal duty?

No. Section 2.1.2 states that the grading is not a classification of organisations under law and not a classification of critical information infrastructure.

So an organisation that rates itself H does not become critical information infrastructure, and one that is designated CII under the cybersecurity law does not need every camera at H. Whether an organisation is CII is a question for the cybersecurity law, covered in Is your company critical infrastructure?

Section 1.2 of the general book adds that the assessed level does not reduce the organisation's legal duties.

A legal duty that does not depend on the level is PDPA section 37 (1), which requires the data controller to provide appropriate security measures. A shop that rates itself B must still make its measures appropriate for the data it holds.

So do not write a B/E/H result into a document as proof that 'the organisation complies with the law'. Describe it accurately: the result of an assessment under the NCSA guideline, used to choose how strict the controls should be.

Does a camera with AI need a different rating?

Slightly. The AI book uses three dimensions in place of four and adds the impact of using AI, plus factors that can amplify impact (section 3.1 of the AI book). The dimensions are not to be treated as substitutes for each other.

The AI book's own examples: a system may not be mission-critical yet process high-impact biometric data, or it may hold no biometrics at all while its AI output controls entry to an important area, which can still make mission or AI impact high. If your system has AI functions, follow section 3.1 of the AI book after section 2.1 of the general book. The overview is in our map of the guidelines.

Who stands behind this guide?

Written by the AIPDPA legal team · Content owner: Phuwara Krobtaku, Attorney-at-law · Thai Barrister-at-Law · technology & intellectual property counsel

Lawyer's licence no. 477/2558 · Thai Barrister-at-Law · LL.M. in Intellectual Property & IT Law (Gold Medal)