It is the platform of the six where the split matters most, because there is a third thing that is neither IT's nor security's: the procedures.
IT keeps the infrastructure of both layers, plus a responsibility that has to be assigned to them explicitly: never update any connected system without checking the versions matrix. That is what stops the control room losing sight of the doors on a Monday.
Security keeps the operation of the video layer —users, permissions, retention, exports— and that of the control room: which alerts arrive, with what priority and at which position.
The procedures belong to neither of the two, and that is the gap where these projects die. One from two years ago quoting a phone number that no longer exists is a trap: the operator follows it, it fails, and they lose confidence in the whole system.
You can carry quite a lot on your own: creating simple procedures, adjusting priorities, changing phone numbers. Somebody has to be trained, because if every number goes through the integrator the catalogue goes out of date.
What is left to the integrator is the connectors, the version jumps coordinated across both layers, the procedures with logic between systems, and diagnosis when something does not arrive. With nine manufacturers inside, that is half the value of the contract.
Training: the longest of the six, with three audiences. The operators, by shift and with real simulations. The owner of the procedures, several days, because they are going to edit them. And IT, on the versions matrix and why it exists.