Nx Witness requirements matrix: yes, partly and no
When you bid on a video surveillance tender, you have to state for each requirement whether the video management system meets it. This page does that for Nx Witness, one requirement at a time: yes, partly or no, with the reason and a source at Network Optix. The no's are in here too. Otherwise you only find them during the clarification round.
Short answer
Does Nx Witness meet the requirements in a public tender?
Most of them. Nx Witness is strong on open platform, roles and permissions, Active Directory, audit trail, failover, licensing and running fully on-premise. It is weak on Entra ID single sign-on, MFA for local and LDAP accounts, SIEM export, privacy masking and federation with other VMS platforms.
Those weak spots are exactly what newer specifications ask for. We read the public documents of 36 Dutch video surveillance tenders from 2023 to 2026. Seven asked for Entra ID or SSO, thirteen for MFA. If you know that up front, you can decide with open eyes: bid with an honest "partly", or let that lot go.
The matrix covers Nx Witness 6.1, as of October 2026. When a new version changes a row, we update it and add the date.
How to read the Nx Witness column. Yes: it is in the product. Partly: it works, with a limit explained in the notes. No: it is not in the product. Not confirmed: we cannot find it in Network Optix sources, so we do not promise it. Per tender: we check this again for every bid.
The matrix
Which requirements does Nx Witness meet, and which not?
31 requirements that keep coming back in video surveillance specifications, in six groups. For each one: the answer, the limit and the source.
Platform and cameras
| Requirement | Nx Witness | Notes and source |
|---|---|---|
| Open platform, cameras of any brand, no vendor lock-in | Yes | Native integrations with Axis, Hanwha, Hikvision, Dahua and Milesight, among others. Other brands connect through ONVIF. Licences are per channel, not per brand. Source: Camera integration and brand support. |
| ONVIF Profile S, T and M | Yes | Nx Witness supports all three. Note: certification for Profile S ends on 31 March 2027, so a requirement for "Profile S certified" devices is about to age. Source: Camera integration and brand support. |
| ONVIF Profile G (retrieving recordings from the camera) | Not confirmed | Profile G is not in the documentation we read, so we do not promise it. If a specification asks for it, we first test it on a test setup with the camera from that specification. |
| Native driver required, no integration through ONVIF | Partly | Only for the brands with a native integration. Everything else runs through ONVIF or a plain RTSP stream. Source: Camera integration and brand support. |
| Reuse of existing cameras and recorders | Partly | Cameras with a native integration, ONVIF or an RTSP or HTTP stream can be added. Channels of an existing recorder or encoder can be added too. Importing a recorder database is not possible, so how much of the old archive comes along is something we check per recorder. See also migrating to Nx Witness. Source: Supported IP video devices. |
| Licensing model that fits a price schedule | Yes | Pro is priced per channel, with no server licence and no monthly fee. A Pro licence is tied to the server's hardware ID and can be moved at most three times. It is not perpetual. Since 6.1 every channel needs a licence, even for live viewing only. Enterprise is a subscription. More on Nx Witness licences. Sources: Professional licenses, Types of Services. |
Access and identity
| Requirement | Nx Witness | Notes and source |
|---|---|---|
| Roles and permissions, least privilege, per camera | Yes | Permissions per user and per group, per camera: live, archive, export, bookmarks, PTZ and settings. A user can belong to several groups. Permissions can only be granted, not explicitly denied. Source: Foundational changes in Gen 6. |
| Active Directory or LDAP integration | Yes | Microsoft AD, OpenLDAP and JumpCloud, also over LDAPS (port 636). Sync runs every 10 minutes by default, groups included. Remove someone from AD and they lose access. Login uses the sAMAccountName, not the UPN or email address. Sources: LDAP integration, Default Port Assignments. |
| Entra ID, SSO, SAML or OpenID Connect | No | Not available in 6.1. Network Optix has announced SSO for Enterprise, without a date. We offer LDAP(S) to an on-premise Active Directory instead. An organisation with Entra ID only and no local AD has no direct integration. Source: Network Optix forum on SSO. |
| MFA or two-factor authentication | Partly | Only for Nx Cloud accounts, with an authenticator app, and the administrator can make it mandatory. Local and LDAP accounts have no MFA. If the specification demands MFA on every access to video, you only comply with cloud accounts. Source: Two-factor authentication. |
Logging and evidence
| Requirement | Nx Witness | Notes and source |
|---|---|---|
| Audit trail: who viewed or exported which footage | Yes | The audit trail records sessions with user and IP address, live and archive viewing with camera and time span, exports and changes. Kept for 183 days by default, stored per server and not synced between servers. The event log keeps 30 days or 100,000 events. More on the audit trail. Sources: log file retention, audit trail per server. |
| Logging to a SIEM or syslog | No | The product has no syslog, CEF or SIEM export. An event rule can send an HTTP request when something happens, for example to a webhook of your SIEM. Reading out the audit trail on a schedule and forwarding it is custom work, which we look into on request. Sources: log files, Integration Capabilities. |
| Monitoring of servers and disks, SNMP | Partly | No SNMP. There is a metrics API with warning and error thresholds for Site, server, camera, storage and network. When a camera, server or disk fails, a notification goes out by email, push or HTTP. Sources: Monitor System health, SNMP feature request. |
| Retention period per camera, for example 28 days | Yes | Archive length can be set per camera. Note: when the disk fills up, Nx Witness also clears recordings with a fixed period. We check at handover that the maximum period is actually held. Source: How does Nx Witness manage storage. |
| Export as evidence, with an authenticity check | Yes | An export carries an internal watermark, and the Desktop Client reports whether the file was altered. The archive itself has an integrity check that cannot be switched off. This is detection, not a legally certified digital signature. Bookmarks cannot be protected against deletion. Sources: Cybersecurity and Nx Witness, How to preserve bookmarks. |
Security and origin
| Requirement | Nx Witness | Notes and source |
|---|---|---|
| Encryption in line with TLS guidelines, hardening | Yes | TLS 1.3, your own certificate with validation in the client, video traffic encryption that can be switched on, optional archive encryption and a "High" security profile at installation. We switch video encryption on ourselves at handover, because the documentation is not consistent about the default. Sources: TLS version, How secure is Nx Witness. |
| No product with a critical vulnerability (CVSS threshold) | Per tender | Network Optix publishes its own vulnerabilities with advisories. The Nx vulnerabilities from 2026 we know of score 7.5 and 8.0 and are fixed in 6.1.2 and 6.1.3. Whether you stay under a specification's threshold, we check against the current list for every bid. Sources: advisory 6.1.3, Vulnerability Disclosure Program. |
| NIS2, ISO 27001 or the Dutch government baseline (BIO) | Partly | The product provides the building blocks: personal accounts, permissions, audit trail and encryption. Network Optix reports ISO 27001:2022 certification; the scope is not published. Showing that you comply is the work of the organisation and whoever manages the system. There is no such thing as a NIS2 certificate for a video system. See also NIS2 and your video system. Source: ISO 27001 at Network Optix. |
| NDAA, country of origin, exclusion of certain manufacturers | Partly | In 2022 Network Optix stated that it does not use equipment from the companies named in Section 889 of the NDAA. That is a statement, not a certification. Headquarters are in the US, with offices in Serbia, Taiwan and the Netherlands, among others. Whether the whole system meets an origin requirement depends mostly on the cameras. Sources: Section 889 statement, About Network Optix. |
| Privacy masking, blurring people | No | Automatic blurring of people has been listed as planned on the Network Optix forum since 2020 and is not in the product. Static masking in the VMS is not confirmed. We set it on the camera itself, where the camera supports it. Source: blurring feature request. |
| No facial recognition | Yes | Analytics beyond motion detection come from plugins. Without a plugin there is no facial recognition, and we do not supply it in projects. Source: The Server Plugin SDK. |
Architecture and continuity
| Requirement | Nx Witness | Notes and source |
|---|---|---|
| Multiple sites, central management | Yes | One Site per location, brought together through Nx Cloud or, in Enterprise, an Organization. Limits: about 10 servers per Site, and 256 devices per server as a recommendation. If the link between locations drops, each location keeps recording. More on central management. Sources: Gen 6 architecture, cameras per server. |
| Redundancy and failover | Yes | If a server fails, another takes over its cameras in about a minute, with priority per camera. If a disk dies, the server keeps writing to the healthy disks. A failover server needs no server licence of its own. Sources: Automatic Camera Failover, storage. |
| On-premise, without internet | Yes (Pro) | Pro runs fully offline, including licence activation and updates. Enterprise needs a cloud connection, so it does not fit a requirement that the system runs without internet. Offline, you lose push notifications and MFA for cloud accounts. Sources: internet traffic, upgrading to Enterprise. |
| Cloud or SaaS | Partly | Nx Cloud gives remote access without an inbound port. Through the app, the relay cannot decrypt the video; in the browser, encryption does end at the relay. We do not offer a fully hosted SaaS service. Systems on 5.1 or older lose guaranteed cloud connectivity after 1 January 2027. Sources: How Secure is Nx Cloud, upgrade to Gen 6. |
| Control room, video wall, multiple operator stations | Yes | Video wall licence, layouts with many cameras, showreels, PTZ and notifications an operator must acknowledge with a bookmark. Limit: about 2,000 connections per server. Sources: Nx Witness, clients per server. |
Integrations
| Requirement | Nx Witness | Notes and source |
|---|---|---|
| Open API or interface | Yes | A REST API with an OpenAPI schema that covers nearly every feature, plus incoming Generic Events and outgoing HTTP actions. Sources: REST API, Generic Events. |
| Video analytics and AI | Yes (plugins) | Motion analytics are built in. More comes through plugins and through Nx AI Manager in Enterprise. Third-party plugins cost extra, and the choice is smaller than on the largest enterprise platforms. Sources: Server Plugin SDK, Types of Services. |
| Licence plate recognition (ANPR) | Partly | Through third-party plugins or in-camera analytics, as searchable data on the timeline. Whether a plugin supports Gen 6, we check per supplier. It does not replace an enforcement system with its own chain. Sources: brand support, Plate Recognizer. |
| Integration with access control, intercom and alarm | Partly | There are existing integrations, including Suprema BioStar 2. Beyond that it runs through Generic Events, HTTP actions and I/O modules, which need their own licence. We check every integration per brand and per version. Sources: I/O module, Suprema. |
| Federation with another VMS, for example of the police or a monitoring centre | No | A federated link with another VMS platform appears nowhere in the Network Optix documentation. If the specification prescribes an existing Genetec platform or federation with one, Nx Witness is not the right choice. |
Some tender requirements do not belong to the VMS. The data protection impact assessment and the data processing agreement belong to the client and whoever manages the system. EN 62676-4 is a design standard for choosing and placing cameras. Maintenance with response and repair times is an agreement with the installer. The VMS supports these with permissions, audit trail and retention, but does not answer them by itself.
As of October 2026, Nx Witness 6.1. Sources read on 2 and 10 October 2026 at support.networkoptix.com and networkoptix.com. Counts from our own reading of the public documents of 36 Dutch video surveillance tenders, 2023 to 2026. Nx Witness is a product of Network Optix; we are a partner. We update the matrix when a new version changes something.
For integrators
What do we provide to integrators who bid?
We fill in this matrix against your specification, provide a licence price schedule per channel and back you up as second-line support after the award. The bid stays yours; we make sure the VMS part holds up.
The matrix against your specification
Koen goes through the requirements in your specification and lines them up with this matrix. You get yes, partly or no for each requirement, with the source. He also marks which requirements are worth a question in the clarification round.
A licence price schedule per channel
A licence costs €137.49 excl. VAT per channel. We list the channels, video walls and I/O modules from the specification. What we can fix for the term of the contract, we agree per bid.
A demo or test setup
On request. If the tender asks for a demonstration, or you want to see the LDAP integration or failover working yourself, we set one up.
The manufacturer's Section 889 statement
Network Optix's statement on Section 889 of the NDAA, with an explanation of what it does and does not say. Not a certificate, but a document you can add to your bid.
Second-line support after the award
Technical support from Network Optix runs through the authorised reseller. That is us. If you get stuck during handover or operation, you call us and we fix it.
Licences wherever you bid
We sell licences worldwide, except to sanctioned countries. EU businesses with a valid VAT number get the reverse charge. We install ourselves in the Netherlands and the border region; elsewhere remotely or together with your engineers.
Behind nxwitness.nl is CameraInstallatie.nl, in security since 1999. Koen will not sell you a bid. He tells you which requirements you meet and which you do not. More about us.
Honestly
When is Nx Witness not the right choice?
When the specification turns a requirement from the No column into a knock-out. A note will not win that, and we would rather tell you before you bid.
A Genetec or Milestone platform is already in place
If the specification prescribes an existing platform, a version, or federation with the police or a monitoring centre, that lot is not for Nx Witness.
Entra ID single sign-on is a hard requirement
Without a local Active Directory there is no integration. In a hybrid environment we offer LDAP(S), but that is not SSO.
MFA on every account, local ones included
If all users work with an Nx Cloud account, it works. If local or LDAP accounts need MFA, it does not.
SIEM export or privacy masking from the product itself
If a custom integration or masking in the camera is acceptable, we can talk. If it has to be in the VMS, no.
Fully offline and still Enterprise
Enterprise features, such as an Organization across many sites, need a cloud connection. If everything must stay offline, it will be Pro, with the limits of Pro.
Questions about the requirements matrix
Can I use this matrix in my bid?
Yes, as a starting point. Check every row against the version you offer, because the matrix covers 6.1 as of October 2026. Keep the source links: an evaluator who can verify an answer trusts it sooner. An honest "partly" with a clear note tends to score better than a "yes" that falls apart in the clarification round.
Is Nx Witness NIS2 compliant or certified?
No, and no other VMS can be either. NIS2 sets obligations for organisations, not for software products. Nx Witness provides the building blocks: personal accounts, permissions per camera, an audit trail and encryption. Network Optix reports ISO 27001:2022 certification for itself, but the scope has not been published. Showing that you comply comes from your own policies and how the system is set up and managed.
Is single sign-on with Microsoft Entra ID coming to Nx Witness?
Network Optix has announced it for Enterprise. In March 2026 a staff member said on the forum that it is not yet available in 6.1. There is no date, so we do not bid on it. What works today is an LDAP or LDAPS integration with an on-premise Active Directory. Disable someone there, and within about ten minutes they lose access to the cameras too.
Is Nx Witness NDAA compliant?
There is no formal NDAA certification. In 2022 Network Optix stated on its forum that it does not use equipment from the companies named in Section 889. That section is about hardware and telecoms from certain manufacturers, not about VMS software. Whether your whole system meets an origin requirement depends mainly on the cameras. Choose them against the requirement in the specification, and check for each brand whether it is on a US exclusion list.
Bidding with Nx Witness?
Send us the specification. Koen lines it up with this matrix and tells you, requirement by requirement, what you can commit to and what you cannot.
A quick word
Questions about your situation? Call Marc.
Has worked in security since 1999. On large migrations he is there himself on day one. Describe your situation and you will hear straight away what we would do — with no obligation.
Marc Herdes · Co-founder and security specialist