Cameras
8 minutes
A contractor’s 2026 guide to retention, storage sizing, and where footage should actually live
Businesses almost always underestimate how long they need to keep security camera footage, and discover it the moment they need a clip that no longer exists. This piece walks through the five questions we work through on every camera system design, plus the four-factor retention worksheet we use before quoting storage.
Camera footage retention is one of the quietest design decisions in a security system, and the one businesses most often regret. The default retention on a new NVR is almost never what the business actually needs, and the gap only shows up when an incident surfaces too late and the clip has already been overwritten. The five questions below cover what we work through on every camera project, plus the four-factor retention worksheet we build with every client before we spec storage.
How long should a business keep security camera footage?
Most businesses should keep security camera footage for 30 to 90 days as a baseline, but the right answer depends on the industry, applicable regulations, insurance requirements, and the typical window between an incident happening and someone discovering it. Thirty days is the common industry baseline because most workplace, retail, and property incidents either get reported within that window or escalate from a smaller event that was. Insurance claims routinely take 60 to 90 days to process and often request footage during that review. ASIS International security management guidance consistently recommends matching retention to the incident investigation window rather than to a convenient default. A pattern we see on service calls: a business sets footage to overwrite every 14 days to save storage space, and then discovers an incident 20 days after it happened with no footage left. The storage savings disappear the first time the business loses a claim because of it. Next step: before setting retention, document the longest realistic gap between an incident occurring and someone noticing. That gap is the floor your retention needs to clear.
What determines the right retention period for your industry?
Retention is driven by four factors: regulatory requirements that apply to your industry, insurance policy terms, the typical investigation window for incidents in your business, and whether footage is used for operational purposes beyond security. The regulatory piece varies widely. PCI-DSS Requirement 10 requires at least one year of audit log retention with three months readily available for payment-handling environments, and many retailers extend that practice to video for assessment coverage. The HIPAA Security Rule (45 CFR 164.312) addresses technical safeguards for electronic protected health information, and while HIPAA does not set a specific camera footage retention number, state medical records laws and incident investigation practice often push effective retention higher for medical facilities. OSHA record keeping under 29 CFR 1904 covers workplace injury records for five years, and footage of injury-prone zones often needs to be aligned with that window. FFIEC guidance applies to financial institutions. The right answer requires reading your industry’s regulations and your insurance policy together, which is a conversation worth having with legal counsel for your state. A pattern we see: a medical office sets retention to 60 days thinking HIPAA alone sets the floor, when the real floor was closer to 180 days once state records law and malpractice investigation windows were considered. Next step: pull your industry’s regulatory guidance and your insurance policy before setting retention, and run both past legal counsel for your state.
How much storage do you need to hit your retention goal?
Camera storage requirements depend on resolution, frame rate, compression codec (H.264 vs H.265), motion-only vs continuous recording, number of cameras, and retention period, and most small to mid-sized businesses need between 500 GB and several terabytes per camera to hit a 30 to 90 day retention window at modern resolutions. The math is specific and the generic rules of thumb from 2015 are no longer accurate. H.265 (HEVC) compression roughly halves the storage draw compared to H.264 at the same quality, and motion-only recording cuts it further for cameras pointed at low-activity zones. Manufacturer storage calculators from Hanwha (Wisenet), Hikvision, Axis, and Milestone are publicly available and give accurate per-camera sizing for the exact models and settings being specified. ONVIF-compliant cameras and recorders simplify the sizing math across mixed-vendor systems. A pattern we see: a business estimates NVR storage based on an old rule of thumb, orders half the drives they actually need, and overwrites footage within 10 days instead of the 30 they planned for. Discovering it after installation means either reducing retention further or buying additional storage at a premium. Next step: use your camera manufacturer’s storage calculator with your actual resolution, frame rate, codec, and camera count before specifying NVR capacity. Do not accept a storage spec that was not calculated specifically for your system.
Retention policy should be reviewed annually, after any significant incident at your business, after any regulatory change in your industry, and anytime your camera count, resolution, or usage pattern changes meaningfully. Retention policies drift because the system scales without the policy scaling with it. Adding six cameras during a renovation cuts effective retention proportionally if storage does not change. Switching to higher-resolution cameras does the same, often more aggressively. ASIS International security management guidance and most commercial insurance carriers recommend documented annual review of camera systems including retention. Before every retention review, we build what we call our four-factor retention worksheet with the client: (1) regulatory requirements for the industry, (2) insurance policy terms, (3) typical incident investigation window, (4) operational and HR considerations like dispute resolution or training review. If any one factor changed since the last review, the retention target should be re-run through the storage calculator. A pattern we see: a business doubles its camera count during an expansion, nobody updates the NVR, and effective retention quietly drops from 45 days to around 20 overnight with no warning. If your business is not sure what retention your current system actually delivers, send us a photo of your NVR’s status screen and the number and resolution of your cameras, and we will tell you where you really stand before the next incident forces the issue. For related decisions, see our earlier posts on what business owners get wrong about security camera wiring and access control and security cameras working together. Content reviewed and current as of November 2026.
