There are two teams involved and it is almost never written down who does what. That gap leaves systems without updating for three years.
IT keeps servers, backups, network, database and update windows, and does it better than anyone on the security side.
Security keeps users and permissions, recording and alarm rules, and who can export video and what gets logged. These are judgement decisions, and in the hands of IT they get settled by whatever is easiest to configure.
Partitions exist for exactly that split, with one limit: moving a camera from one Archiver to another, changing the retention days or touching a storage scheme are one-click actions with consequences in terabytes. They do not belong in the operator profile.
The integrator is left with the version jumps, the architecture changes, the sites that come in and out of the federation, and the diagnosis when it is not clear whether it is the camera, the network, the drive or the platform. That hour is half the reason to have a contract.
Training: half a day for the operator at their own position and with their own cameras, two days for whoever administers the security side, and a separate session for IT. With a written script for whoever joins next year, because someone will.