Security AMC Buying Guide (2026): How to Buy a Maintenance Contract That Keeps the System Working

A security system is not a thing you buy once. It is a thing you keep. Cameras fog and drift, lenses gather dust, hard disks fail silently, batteries die in their fourth monsoon, firmware falls behind the exploits it was meant to resist, and a sensor knocked out of alignment by a painter goes on reporting "all clear" for months. None of this announces itself. The system looks alive — lights blink, an app shows a feed — right up to the night it is needed, when the recording turns out to have stopped six weeks ago and nobody knew. The Annual Maintenance Contract (AMC) is the instrument that keeps that from happening. It is, quietly, one of the most consequential purchases in the whole security project, and one of the most carelessly bought.

Most buyers treat the AMC as an afterthought bolted onto the install quote, sign whatever the installer put in front of them, and discover its holes only during a failure. Bought that way, an AMC is a receipt, not a protection. Bought well, it is a written promise about how fast a fault gets fixed, who pays for the part that failed, who holds the passwords, and what happens to your footage and your access when the relationship ends. This guide is about buying it well: choosing the right type of contract for your system, reading the scope for what it actually includes, scrutinising the handful of clauses that decide whether you are covered, comparing competing offers like-for-like, and refusing the red flags.

Scope and how to use this. This is a selection and contracting guide for the buyer — a facility manager, RWA committee, business owner or homeowner deciding which AMC to sign and how to brief it — not an installation manual and not a price list. For the rupee numbers and how maintenance cost fits the whole ownership picture, see the security lifecycle cost guide and its costs sub-hub; this guide deals only in the light "budget / mid / premium" framing. Choose the contract, then hold a licensed, competent contractor to it. Life-safety systems — fire alarm, detection, suppression — are never optional to maintain: their AMC and periodic testing are governed by code and are non-negotiable, whatever the budget.

Why the AMC decides whether the system is real

The install is the easy part. Its failure mode is slow, invisible and total: a system degrades from "fully working" to "theatre" without any single visible event. The AMC exists to catch that degradation on a schedule instead of during an incident. A good one does three jobs — it maintains the equipment so it keeps working, it responds when something breaks so downtime is short, and it documents both so you can prove the system was fit at the moment it mattered. A weak AMC does none of these reliably, and the gap only shows when you go looking for footage that was never being recorded.

That is why the AMC belongs in the buying decision from the start, alongside the hardware and the installer — not tacked on at the end. The questions that surface a good contract are the same ones that surface a good contractor; see questions to ask a security contractor and security vendor and installer evaluation for briefing the relationship the AMC formalises.

The three types of AMC — and how to choose

Almost every security AMC in India is a variant of one of three models. The difference between them is entirely about who pays for parts, and that single distinction drives most of the price and most of the disappointment.

• Comprehensive is the "everything included" contract: scheduled maintenance, all labour, and the spare parts that fail within the agreed scope, for one annual fee. It costs the most up front and is usually the cheapest when something expensive fails. Its trap is the exclusions list — read what "comprehensive" quietly leaves out (see the clauses section).
• Non-comprehensive covers the visits and the labour but bills you for the parts. It is honest and often sensible while the hardware is young and still under manufacturer warranty, so the parts risk is low. Its trap is the surprise: the "cheap" contract becomes expensive the year three cameras and a recorder need replacing, and an unscrupulous vendor has every incentive to find parts that need replacing.
• On-call / per-visit is not really a maintenance contract at all — it is a phone number. There is no schedule, so nothing is checked until it has already failed. It is acceptable only for a genuinely low-stakes system, and never for anything you would be relying on in an emergency.

How to choose: match the model to the stakes and the age of the system. A large, critical, or life-safety installation wants comprehensive for predictable coverage and no argument at the moment of failure. A young system still under warranty can sensibly run non-comprehensive for a year or two, then move to comprehensive as parts risk rises. Reserve on-call for the trivial. Whatever the model, the value-honest rule holds: the most expensive contract is not automatically the right one, but the cheapest is very often a false economy paid back in downtime.

What a good scope must include

The "type" tells you who pays for parts; the scope tells you what actually gets done. This is where thin contracts hide. A scope worth signing spells out each of the following in words, with numbers where numbers belong:

• Scheduled preventive visits, with a stated frequency. The heart of the contract. A vague "as required" is not a schedule. Expect a defined cadence — commonly quarterly for a typical system, more often for critical or harsh-environment sites — with each visit's tasks listed, not left to the technician's mood.
• Testing of every device, not a spot check. Each visit should test every camera's image and recording, every sensor and detector, every door controller, the recorder's actual write-to-disk, and the alarm's ability to arm, trip and signal. "We looked at the monitor" is not testing.
• Cleaning and physical checks. Lenses and domes cleaned, housings and seals checked, mounts and alignment corrected, cabling and connectors inspected. In Indian conditions — dust, monsoon, heat — this is not cosmetic; a filthy lens is a blind camera.
• Firmware and software updates. Cameras, recorders, access controllers and their management software patched to current, safe versions. Unpatched security devices are themselves a vulnerability; an AMC that ignores firmware is maintaining the hardware and neglecting the security.
• Battery checks and replacement. Backup batteries in alarm panels, control units and the UPS have a finite life and fail exactly when mains does. The scope must say batteries are tested and, on a comprehensive contract, replaced at end of life.
• Health reports after every visit. A written record of what was tested, what was found, what was fixed, and what needs attention — with dates. This is both your proof the system is fit and your early warning of the part about to fail. No report, no evidence.
• Breakdown and emergency call-outs with a guaranteed response time. Between scheduled visits, things break. The contract must commit to how fast a technician responds — the response-time SLA — and distinguish remote response from on-site attendance.
• Spares availability and turnaround. A stated commitment that common spares are held or sourced within a defined number of days, so a failure does not become a month of blind coverage while a part is "on order".

The clauses that decide whether you are covered

Two AMCs with identical-looking scopes can be worlds apart in the fine print. These are the clauses to read before you sign — the ones that decide what happens at the moment of failure and at the end of the relationship.

• The response-time SLA. The single most important clause. It must state, in hours or a working-day count, how fast the vendor responds to a fault — and it should separate remote response (a call or remote diagnosis) from on-site attendance, and ideally define resolution versus mere "response". "We will respond promptly" is not an SLA; "on-site within 24 hours for a critical fault" is.
• What is excluded. Every contract has an exclusions list; read it as carefully as the inclusions. Common exclusions are damage by lightning, flood, rodents, power surge, vandalism, and "consumables" — and sometimes, quietly, the very parts most likely to fail. If a "comprehensive" contract excludes the recorder's hard disk, it is not comprehensive.
• Parts versus labour. Make explicit, in writing, which failures are covered for parts and which are labour-only. The line between "covered spare" and "chargeable part" is where disputes live.
• Escalation path. Who you call when the technician does not come, and who above them owns the problem. A named escalation with contacts turns a broken promise into a fixable one.
• Penalties for missed SLAs. A response-time commitment with no consequence for breaching it is a wish. Service credits, penalty deductions, or a right to terminate on repeated breach give the SLA teeth.
• Who holds admin access and passwords. Critical and often ignored. You, the owner, must hold or be able to obtain full administrative access, credentials and configuration. A vendor who keeps the admin passwords to themselves holds your system hostage — you cannot change vendors, audit the configuration, or even prove what it does. Insist that admin access is yours.
• Data handling under the DPDP Act 2023. CCTV footage, access logs and biometric records are personal data. The AMC must state who may view footage during maintenance, whether any data leaves site, retention and deletion, and confidentiality obligations on the vendor's technicians. This is a buying criterion, not boilerplate.
• Exit and handover. How the contract ends: return of all admin credentials and documentation, a clean configuration handover, no residual remote access retained by the outgoing vendor, and cooperation with an incoming one. Agree the exit before you need it, while you still have leverage.

Never sign away your own system. If the AMC leaves the vendor holding the only admin passwords, with no exit handover and no data terms, you have not bought maintenance — you have rented dependence. Owner-held admin access, a DPDP-compliant data clause, and a clean exit are non-negotiable regardless of price tier.

How to compare AMCs like-for-like

AMC quotes are hard to compare because vendors price different things. A "cheaper" AMC is usually cheaper because it covers less — fewer visits, labour-only, a longer SLA, a thinner spares commitment. Comparing the headline number alone rewards the vendor who promised least.

AMCs are typically priced as an annual percentage of the installed system value, with comprehensive contracts costing more than labour-only ones and critical or life-safety systems more than general ones. Treat that percentage as framing only — for real numbers and how the AMC sits within total cost of ownership, go to the security lifecycle cost guide. To compare fairly:

• Normalise the scope first. Line the quotes up against the same checklist — visit frequency, devices tested, firmware, batteries, reports, SLA, spares — so you are comparing equal coverage, not equal words.
• Convert everything to annual cost including likely parts. For a non-comprehensive quote, add a realistic allowance for the parts you will actually buy; a labour-only price is only half the number.
• Price the SLA. A 4-hour response is worth more than a 72-hour one; a contract with penalties is worth more than one without. Faster, enforceable service legitimately costs more.
• Check GST and the term. Confirm whether the quote is inclusive of GST and exactly what period it covers, so you are comparing the same tax basis and the same duration.
• Weigh the vendor, not just the paper. The best-written AMC is worthless from a vendor who will not answer the phone. The response record and competence of the vendor is part of the price; see vendor and installer evaluation.

Life-safety systems: maintenance is not optional

For fire alarm, detection and suppression, none of the above is a matter of budget preference. A life-safety system must have an AMC and periodic statutory testing — it is a legal and moral obligation, not a cost to trim. A fire panel that fails silently is not an inconvenience; it is the difference between an early warning and a fatality. The National Building Code (NBC = SP 7:2026) and fire-safety regulation require these systems to be maintained and tested on a defined cadence, and many jurisdictions tie occupancy or fire-NOC renewal to evidence of it. When you buy a security AMC that also touches life-safety, the fire portion carries the highest scrutiny: certified technicians, documented periodic tests, and a health record you can produce for the authority. Never let a fire-system AMC be quietly downgraded to save money.

Red flags — refuse these

Some offers tell you they will fail before you sign. Walk away from, or fix before signing, any AMC that shows these:

• Vague scope. "Regular maintenance as required", with no visit frequency, no device-by-device testing, and no task list. Undefined scope is undefined coverage.
• No response-time SLA. "We respond quickly" with no hours, no working-day count, no penalty. The most important clause is missing on purpose.
• No spares commitment. No held stock, no turnaround days — meaning a failed part can leave the system blind for weeks while it is "on order".
• Locked-in admin. The vendor keeps the passwords and configuration and will not hand them over. This is the biggest red flag of all: it makes you unable to leave and unable to audit.
• No health reports. Nothing in writing after a visit. You will have no proof the system was maintained and no warning before it fails.
• No exit or data terms. Nothing about handover, credential return, or DPDP data handling — leaving you dependent at the end and exposed throughout.
• A price far below the others. A quote that undercuts every rival is almost always covering less; find the missing scope before you celebrate the saving.

The AMC buying checklist

Before signing any security AMC, confirm every one of these:

• The type fits the stakes — comprehensive for critical or life-safety and older systems; non-comprehensive only while hardware is young and under warranty; on-call only for the trivial.
• A stated visit frequency, with a per-visit task list, not "as required".
• Every device is tested each visit — cameras and recording, sensors, detectors, controllers, alarm arm-and-signal.
• Firmware/software updates and battery checks/replacement are in scope.
• A written health report follows every visit, with dates.
• A response-time SLA in hours or working days, separating remote from on-site, with penalties for breach and a named escalation path.
• Spares availability and a turnaround commitment in days.
• Parts-versus-labour and the exclusions list are explicit and read in full.
• You, the owner, hold or can obtain full admin access and passwords.
• A DPDP-compliant data clause governs who sees footage, what leaves site, retention and confidentiality.
• A clean exit and handover clause returns credentials and documentation and removes vendor remote access.
• Life-safety maintenance and statutory testing are provided and documented — never negotiated away.
• GST, term and total annual cost (including likely parts) are clear, so you can compare like-for-like.

An AMC bought against this list is a promise you can hold someone to. An AMC bought on price alone is a receipt for a system that will look alive right up to the night it is not.

Where to go next

• How to choose a security system — the pillar buying guide the AMC decision sits within.
• Questions to ask a security contractor and security vendor and installer evaluation — briefing and choosing the party who will hold the AMC.
• CCTV maintenance and AMC — the maintenance detail for the camera system specifically.
• Security lifecycle cost guide and the costs sub-hub — the rupee numbers and total cost of ownership.
• The costs sub-hub collects the money side of ownership.

References

• National Building Code of India (SP 7), Bureau of Indian Standards — fire detection, alarm and suppression systems must be installed, maintained and periodically tested; maintenance of life-safety systems is a code obligation, not optional. Verify the current edition (SP 7:2026) via the BIS catalogue: https://www.services.bis.gov.in/
• Digital Personal Data Protection Act, 2023 — CCTV footage, access logs and biometric records handled during maintenance are personal data; the AMC must define who may view them, whether any data leaves site, retention, deletion and technician confidentiality.
• Warranty and consumer terms — distinguish the manufacturer's hardware warranty (parts) from the AMC (service and, if comprehensive, spares); confirm GST treatment and contract term in writing before comparing quotes.

This is an educational buying and contracting overview for facility managers, RWA committees, business owners and homeowners — not legal advice, an installation manual or a price list. Life-safety-system maintenance and statutory testing take priority over any cost consideration; retain competent, licensed contractors, keep owner-held admin access, and verify any standard's current status via the BIS catalogue before relying on it.