Writing a scope of works for a CCTV tender.

Why three prices for one building are never comparable

Three contractors walk the same building and three prices come back that cannot be set beside one another. The usual explanation is padding. The more common one is that the building issued a document describing equipment, and each contractor filled in what it left open differently.

A shopping list names cameras, a recorder and a quantity of storage. A scope of works says what must be visible at the main entrance, how long footage is held, what the cabling has to satisfy, and what must be demonstrated before sign-off.

The Malaysian duty behind the exercise is thin. By-law 3(7) in the Third Schedule to the Strata Management (Maintenance and Management) Regulations 2015 requires the management body to “set up, manage and maintain proper procurement procedures and tender process in a fair and transparent manner” for every contract touching the common property, and by-law 2(1)(a) applies those by-laws to a joint management body as well as a management corporation. Nothing in the by-law names a number of quotations, a threshold or a tender method. The standard is self-set.

One caution about the text. The Attorney General’s Chambers portals were unreachable when this research ran, so the by-laws quoted here are the Unannotated Statutes of Malaysia reproduction, incorporating amendments to 1 June 2015, rather than the gazette. Check the gazetted text before relying on a subsection.

The UK CCTV Advisory Service names the consequence: “The more difficult it is to comprehend a specification; the greater will be the variation in tender prices.” A wide spread is a defect in the brief, not in the bidders. Reading the prices afterwards is reading three quotations against each other; this is the document that goes first, within specifying and funding.

The standard Malaysia has never published

The most useful document for the section that follows was not written in Malaysia. The Singapore Police Force publishes a video surveillance standard for buildings, described in its own words as “a set of recommendations to guide building owners and help provide a consistent approach to the recommended specifications, installation, and operation of VSS across buildings in Singapore”.

No equivalent Malaysian standard was located in this research. Three probes are worth reporting as what they are: evidence that there is little for an answer engine to retrieve, not proof that nothing exists. The data protection commissioner’s own homepage carries no CCTV guidance. A CIDB subdomain cited by answer engines as a source on tender scope serves nothing but a default page reading “IIS Windows Server”. And a live Malaysian council CCTV maintenance tender — a real, priced bill of quantities — contains no image-quality or coverage test anywhere in its scope. Borrowing the Singapore document is borrowing a yardstick, not importing a law that applies here.

The standard is candid about its own limits. It says a video surveillance system “should not be designed to serve as the sole protective measure”, and should operate alongside other measures such as access control and intrusion detection.

How do you specify coverage without counting cameras?

The Singapore standard’s central move is to assign a required image level to a named location instead of a camera to a position. A frontal view of people entering or leaving by the main entrances “should meet a minimum image height of” Identification level; general coverage of the common areas should meet Observation; counters involving security checks or registration should meet Recognition; and cameras at vehicle entrances should “capture the number plates of the vehicles entering/exiting the car park and loading/unloading bay”. The bidder works out the camera.

The fourth column is what makes the schedule work: a level assigned but never demonstrated is an aspiration, while a level a bidder knows will be played back on the building’s own screen at handover constrains what they propose. Name the scale as well as the level, so that Identification means Identification as defined in one named document and not in whichever one the bidder prefers.

What does an image level actually mean?

The schedule’s level names are the Singapore standard’s own. The same three names are defined by what an operator can do in IEC 62676-4:2014, which Axis reproduces. At Observation “It is possible to determine how many people are present and to see characteristic details of individuals, such as distinctive clothing.” At Recognition “It is possible for a viewer to determine whether or not an individual shown is the same as someone they have seen before.” At Identification “It is possible to identify an individual.”

That edition attaches a pixel density to each: Detection 25 px/m, Observation 63 px/m, Recognition 125 px/m and Identification 250 px/m. The figures are derived “based on the assumption that an average human face has a width of 16 cm”, so they describe how much detail lands on a face at a given distance.

The direction of travel is the 2025 edition, which runs Overview, Outline, Discern, Perceive, Characterize, Validate and Scrutinize, and groups the first three as Low Pixel Density Object at “20/40/80” pixels per metre for outdoor perimeter work. Axis is clear in both editions that this is “a simplified model of a complex reality”, and that complying with it guarantees nothing on its own.

Two of the three scales convert exactly; the third cannot

Three vocabularies turn up in three proposals. IEC 62676-4 counts pixels per metre. The Singapore standard counts millimetres per pixel, putting Identify at “more than 4mm per pixel”. The UK Home Office manual counts percentage of screen height, putting Identify at a figure occupying “at least 100% of the screen height”.

Two of those three are the same scale written the other way up. Millimetres per pixel and pixels per metre both measure how much of the real scene a single pixel covers, so they are reciprocals: Identify at more than 4 mm per pixel is the same threshold as Identification at 250 px/m, and the standard’s other levels map onto the other DORI densities the same way. A bid answering in pixels per metre against a tender written in millimetres per pixel is responsive.

Percentage of screen height converts to neither, and the reason is why the other two do. Pixel density is absolute: it depends only on the scene and the image. Percentage of screen height is relative — how much of the frame a person fills changes with the lens and the distance, so two installations at the same percentage can put very different detail on a face. The Singapore standard records the consequence itself: a Recognise requirement “can no longer be simply equated to a 50% screen height”.

So state which scale the tender uses, define the level in that scale, and give the equivalent in the other where a bidder may reasonably answer in it. And whichever scale is used, the number that governs is not the camera’s: “the resolution being compared reflects the lowest resolution in the chain”.

How many days of footage must a Malaysian building keep?

The Singapore standard asks for capacity to record every camera continuously, with “the archival of one full set of recordings for the past 31 days or more”. That is a recommendation to Singapore building owners, and not a rule anywhere else.

Malaysian law sets no period. The only retention provision in Malaysian statute that could bear on footage is section 10 of the Personal Data Protection Act, which says personal data “shall not be kept longer than is necessary for the fulfilment of that purpose” and requires that it be “destroyed or permanently deleted if it is no longer required”. That is a ceiling in principle with no figure attached, and no Malaysian source setting one was located in this research.

The number most buildings write down comes from UK police practice. The Home Office manual states that “A retention time of 31 days has traditionally been used for most CCTV applications and is still recommended by police”. A tender adopting that period is following practice, and should say so rather than imply a legal requirement.

Frame rate, recording mode and the arithmetic behind the storage line

Retention is one of several decisions that arrive as a single storage figure. The Singapore standard recommends a camera floor of “a minimum resolution of HD 1080p: 1920x1080 pixels”, “sufficient reserve recording media (at least 20%)” kept hot-swappable, and support for “minimally RAID 5 array”. It also sets a day-to-day frame-rate floor, and that floor differs between indoor recording and outdoor monitoring of slow-moving traffic — which is why frame rate has to be stated per camera group rather than once for the site.

These decisions trade against each other, and the Home Office manual states the mechanism: “improved recorded picture quality and higher frame rate may come at the expense of a reduced retention time on the system.” Recording mode hides best — continuous, motion-triggered or schedule-based — because motion triggering shrinks a storage quotation and can lose the frames that mattered.

What does the word outdoor actually specify?

Nothing. Outdoor-rated means whatever the brochure wants it to mean. What turns the word into a requirement is an ingress protection code and an impact class, stated per position rather than once for the site.

The two ingress figures disagree by one numeral, and the stricter comes from a manufacturer rather than the police standard — worth stating rather than resolving quietly. The code is readable once its structure is known: reproducing IEC 60529, the design-tool publisher JVSG sets out the first numeral after IP as “The camera’s resistance to dust”, running upward from no protection at all through progressively smaller solid objects.

Cabling, containment and the ninety metres that decide camera positions

Camera positions are settled by infrastructure before anyone opens a catalogue. A published condensation of ANSI/TIA-568-B defines the channel as “the 90 meters of horizontal cable” plus its connectors, with patch and equipment cords capped at 10 metres. In a tower that decides where the switches sit, and which camera positions can be reached at all.

The Ethernet Alliance publishes the switch-port power for Classes 1 to 8 as 4, 7, 15.4, 30, 45, 60, 75 and 90 W, and the power guaranteed at the powered device as 3.84, 6.49, 13, 25.5, 40, 51, 62 and 71.3 W. The gap between the two rows is cable loss, which is why a PTZ that behaves on the bench browns out at the end of a long run. The Alliance adds that all PoE devices are interoperable, “the only limitation being that a new high power PD (Powered Device) will not get the full power from an older or lower power PSE (Power Sourcing Equipment)”.

• Existing containment. What is in the risers now, and who establishes whether it is reusable.
• New routes and making good. Where cable may run, and what reinstatement is in the price.
• Switch and power positions. Which rooms, and what the cabling limit does across a floor plate.
• PoE class per camera type. Watts guaranteed at the device, not at the port.
• Spare capacity in the system, not the cable. The Singapore standard recommends “a minimum of 20% spare capacity”.
• Working hours. When risers may be opened, when drilling is permitted, and how residents are told.

Reusing coaxial infrastructure or running new structured cabling is weighed in analogue against IP CCTV.

Which clause stops the building being locked to one contractor?

Interoperability is the clause that pays out years later, to a committee not yet elected. The Singapore standard recommends that network IP-based systems “should comply with prevailing Open Network Video Interface Forum” standards, and ONVIF is precise about why the profile must be named: an ONVIF profile “has a fixed set of features that must be supported by a conformant device and client”. A tender that asks for ONVIF compatibility and stops there has specified a marketing word.

Read the second column before writing a profile letter into a contract. ONVIF describes S, T and G in one identical sentence, so its own page will not tell a committee what any of the three adds. That has to come from the manufacturer, in writing.

The withdrawal schedule belongs in the tender. ONVIF states that “The June 2026 version of the ONVIF conformance test tools, which have a 9-month validity period, will be the last test tool version that enables manufacturers to claim product conformance to Profile S.”

Make and model, and the drawings that make a re-tender possible

Naming a make and model is the other way to make bids comparable, and it carries a cost the vendor literature rarely states. The same UK publisher that specifies equipment “down to the make and model number” also warns that doing so gives an “advantage to the tendering company that has the best buying terms with that manufacturer. There could be far better terms available for alternative makes with a consequent reduction in tender prices.” A performance specification keeps pricing honest and puts the equivalence judgement back on the committee.

The other half of the anti-lock-in clause is paperwork. Handover requirements should include “as-fitted wiring and schematic diagrams” alongside the manuals, because a building that does not hold them cannot genuinely re-tender: the next bidder is pricing the unknown. What a developer is obliged to hand over is covered in what a JMB inherits from a developer.

The tender is also a personal-data specification

A camera system records identifiable people continuously, so the document that procures it is a processing specification whether it says so or not. The Personal Data Protection Act applies to “any person who processes” and to “any person who has control over or authorizes the processing of, any personal data in respect of commercial transactions”. Whether a management body holding footage sits inside that phrase is stated nowhere, so specify as though it does.

The amending statute is Act A1727, with royal assent on 9 October 2024 and gazette publication on 17 October 2024. It inserted section 12a — “A data controller shall appoint one or more data protection officers who shall be accountable to the data controller for the compliance with this Act” — and section 12b, requiring a controller with reason to believe a breach has occurred to notify the Commissioner as soon as practicable. Both took effect on 1 June 2025, and the same Act brought biometric data inside sensitive personal data.

The commissioner’s guideline on appointing a data protection officer names the technology directly: activities involving CCTV “would be considered as carrying out activities that may constitute” regular and systematic monitoring, one of three alternative triggers beside “personal data exceeding 20,000 data subjects” and sensitive personal data exceeding 10,000. The breach guideline puts the clock on the building, not the regulator: a controller that “fails to notify the Commissioner within seventy-two (72) hours” must submit a written notice giving the reasons for the delay.

Is there a Malaysian CCTV code of practice?

No. The document usually cited as one is a public consultation paper on a proposed Automated Decision Making and Profiling Guideline, which “seeks to gather public views and feedback regarding aspects that will be or should be addressed in the proposed ADMP Guideline”. The consultation closed and no resulting guideline was found published.

Its CCTV content is narrower than the name it is given. The measures are proposed for data controllers “when deriving biometric data from CCTV or for processing biometric data using CCTV for automated decision making and profiling purposes”, so a plain recording system that runs no facial recognition falls outside their stated scope. They remain the closest thing Malaysia has to official signage guidance — notices “at prominent locations to notify individuals that security cameras are in operation and reason of such operation”, more prominent where people are less likely to expect monitoring — and a scope of works can adopt them voluntarily.

What the tender has to settle either way is short, and none of it depends on whether a guideline is ever issued.

1. Retention in days, and the process that overwrites footage once it passes.
2. Who may view and export, by role, and how access is withdrawn.
3. An audit trail of all physical and network access to the recorders, including file retrieval.
4. Signage, and where it has to be more prominent.
5. Who holds the data — the management body, not the contractor.

What must every bidder be required to submit?

One short clause does most of the work: “All tenderers must include a statement that the system proposed and priced complies with this specification. Variations and suggestions for changing or improving the system should be listed and priced separately.” That forces three divergent proposals back onto one baseline, and puts every clever idea where the committee can see its price. A Malaysian council tender adds the second: suppliers are advised to visit and survey the site before submitting a price.

Prequalification is where a committee reaches for a CIDB grade, and the statute is less definite than that suggests. Act 520 defines construction works by a list running from buildings and roads through “any electrical, mechanical, water, gas, petrochemical or telecommunication works”. It names no security, CCTV or extra low voltage work anywhere — and equally does not place a camera installation outside electrical or telecommunication works. That judgement is one the Act does not make, and it belongs to the building’s own advisers rather than to this page. Ask each bidder what registrations and manufacturer appointments it holds, with the year of each.

Acceptance, warranty and the baseline degradation is measured against

Acceptance needs a threshold with a number in it. The UK specification defines practical completion as “fourteen consecutive days of uninterrupted, fault free operation”, and runs its example warranty “for a period of twelve months from the date of the issue of the Certificate of Practical Completion” — a start date that matters as much as the length. The Singapore standard supplies the baseline: at commissioning, “the agreed camera views and image quality” are documented and reviewed periodically, and “Any deterioration should be rectified immediately”.

That standard also states what good looks like in service: “System availability should be set at 95% over a 12-month time frame”, and “All system and equipment fault should be rectified within 24 hours” — rectification, not response. One Malaysian maintenance page found in this research, GTC’s CCTV Clinic, offers “24 hours response technical Support from our customer service team and support engineers”. A response window and an availability target are different promises, and a tender wanting both has to ask for both by name.

A standing duty sits behind all of it. The by-laws require the management body to “maintain in a state of good and serviceable repair, and, where necessary, renew or upgrade, the fixtures and fittings, lifts, installations, equipment, devices and appliances” in the development area. Upgrading is a duty there, not a discretion — which is why the maintenance schedule belongs in the installation tender. What that ongoing scope carries is in what a maintenance contract should cover.

A structure the same committee can reuse for access control and intercom

Its seven parts — outcome by location, environmental conditions, infrastructure, interoperability, personal data, what bidders submit, what is demonstrated — are not camera-specific. Replace the coverage schedule with a door schedule, each door with what it must do and who may pass and when, and it is an access control tender, in which Profiles A and C do the work Profiles T and G do for video.

One finding from the crime literature bears on this document. In the systematic review by Piza, Welsh, Farrington and Thomas, schemes incorporating active monitoring were associated with a significant reduction in crime at an odds ratio of 1.172, while passively monitored systems showed non-significant effects across all three of the review’s meta-analyses. In residential settings the reduction was about 12 per cent, and only a minority of the residential schemes reported statistically significant crime reductions. Those evaluations pool car parks, town centres and transport settings, none Malaysian, and test monitoring style rather than maintenance. What follows is narrow: the same tender should say who watches the screens and when, not only what the cameras are.

Occhio Tec is an ELV systems contractor in Kuala Lumpur, established 2010, working in the mid-high to high-end condominium market in the Mont Kiara, Bangsar and KLCC areas, and designing, installing and maintaining CCTV, access control, video intercom, structured networking and perimeter intrusion systems. It holds a Panasonic Malaysia Authorised Strategic Partner appointment for ELV works (2015), a MicroEngine Authorised System Installer appointment (2014) and an Astro Authorised Reseller appointment for IPTV and broadband (2016) — the kind of statement a scope of works should require of every bidder. What a particular building’s schedule should say needs a site survey. Related sheets sit in Insights.