NetStation
Build a VMS on your own infrastructure.
Free edition: up to 4 IP channels, 1 account and 7 days of recording — a full server with no licence to buy.
Home / Security
Cybersecurity built in
NIS2 and the Cyber Resilience Act
A video surveillance system is part of your IT infrastructure. Below we describe eight NetStation security features: what each one does and why it matters to your organisation.
NETSTATION
Verification code
482917
Code from your Authenticator app
Verify
Activate with QR code
01
Multi-factor authentication (MFA)
What it does
After the password, NetStation asks for a one-time six-digit code from an authenticator app (TOTP). Activation takes one QR-code scan with a phone, and recovery codes let you sign in if the device is lost.
Why it matters
A stolen or guessed password is the most common way accounts are taken over. A second factor means the password alone is not enough — and access to cameras and recordings is access to highly sensitive data. NIS2 explicitly lists multi-factor authentication among the required measures.
- Works with Microsoft Authenticator and Google Authenticator
- QR-code activation, no extra hardware
- One-time recovery codes
NIS2 Art. 21(2)(j)CRA Annex I
02
Audit log
What it does
Records user activity in the system — for example successful and failed sign-ins, live view and playback, video exports and permission changes. Entries can be filtered and exported to CSV.
Why it matters
After an incident you need to answer quickly: who did what, and when. Without a log you can neither establish this nor demonstrate it to an auditor. The CRA requires products to record relevant internal activity, and NIS2 requires organisations to be able to handle incidents.
- Filter by user, event type and period
- CSV export for auditors
- Access via API
CRA Annex I Part I (2)(l)NIS2 Art. 21
Role: OperatorRole: AdministratorRole: Auditor
✓Plant A
✓Group: Parking
✓Camera 01
✓Camera 02
–Group: Server room
–Camera 09
–Plant B
03
Roles and permissions (RBAC)
What it does
Permissions are assigned to roles rather than individuals — down to site, camera group and single camera. Operators see only what they need for their work.
Why it matters
The principle of least privilege limits the impact of account takeover and mistakes. When someone changes jobs, you simply change their role. Access control policies are one of the NIS2 requirements.
- Permissions per site, camera group and camera
- Ready-made roles such as Operator, Administrator, Auditor
- One role change instead of editing many accounts
NIS2 Art. 21(2)(i)CRA Annex I Part I (2)(d)
Syslog RFC 5424 · JSON
<134>1 2026-10-14T09:15:02Z ns01 NetStation - AUTH_FAIL [user="unknown" src="10.0.4.17"]
<134>1 2026-10-14T09:15:40Z ns01 NetStation - SESSION_KILL [admin="admin"]
{"event":"export","user":"j.miller","camera":"12"}
{"event":"config_change","user":"admin","key":"retention"}
SIEM / SOC
04
Event export to SIEM
What it does
NetStation sends security events to an external SIEM via Syslog (RFC 5424) or in JSON format.
Why it matters
Your security team (SOC) sees video surveillance events next to network and server events and can correlate them — for example a series of failed sign-ins. Fast detection is a precondition for reporting incidents within NIS2 deadlines: an early warning within 24 hours.
- Syslog RFC 5424
- JSON export
- Event receiver configured in the panel
NIS2 Art. 21(2)(b)NIS2 Art. 23
Recording retention · Camera 07Oct 14, 2026 10:42
Before30 days
Now7 days
Changed by: j.millerRestore
05
Configuration change log
What it does
Every settings change is recorded: what was changed, by whom and when, with the previous and new value.
Why it matters
A wrong or unauthorised change — recording switched off, retention shortened — can go unnoticed until the moment a recording is needed. The change history lets you detect it, explain it and roll it back quickly.
- Who, what, when — for every change
- Value before and after
- Quick return to the previous configuration
CRA Annex I Part I (2)(l)NIS2 Art. 21
06
Session management
What it does
Administrators see all active user sessions and can end any of them. Idle sessions expire automatically after a set time.
Why it matters
An unattended workstation or a hijacked session is open access to your cameras. Being able to cut off access instantly — for example when an employee leaves or a breach is suspected — reduces response time to minutes.
- List of active sessions
- End sessions remotely
- Automatic sign-out after inactivity
CRA Annex I Part I (2)(d)NIS2 Art. 21(2)(i)
CMS client
NetStation server
✓ TLS 1.3✓ TLS 1.2
TLS 1.1SSL 3.0
07
Encrypted communication (TLS)
What it does
Connections between server, clients and HUB are encrypted with TLS 1.2 or newer. Obsolete protocols and weak ciphers are disabled.
Why it matters
Unencrypted traffic can be intercepted or modified on the network — passwords and camera images included. Encryption in transit is required both by NIS2 (cryptography) and by the CRA (data confidentiality).
- TLS 1.2+ enforced
- Weak protocols and ciphers disabled
- Encryption server ↔ client ↔ HUB
NIS2 Art. 21(2)(h)CRA Annex I Part I (2)(e)
netstation.company.local
Expires in 30 days
IssuerCompany Inc. CA
SubjectCN=netstation.company.local
Valid untilNov 13, 2026
Import: PEMCRTPFX
08
Certificate management
What it does
Import your own certificates in PEM, CRT and PFX formats, view issuer, subject and expiry date, and get an alarm before expiry.
Why it matters
A certificate from your organisation’s trusted CA removes browser warnings and protects against server impersonation. An expired certificate can stop the system — which is why the reminder arrives well in advance.
- Import PEM, CRT and PFX
- Issuer, subject and expiry in one view
- Alarm before expiry
NIS2 Art. 21(2)(h)CRA Annex I Part I (2)(e)
