Being able to look at the cameras from a phone is usually the first thing anyone asks for. It is also the point at which a camera system becomes something exposed to the internet, which deserves more thought than it normally gets.
The approach to avoid
Port forwarding: opening a port on the router so the recorder can be reached directly from the internet. It works, it is quick, and it is the reason a great many camera systems have ended up publicly accessible.
The problem is that the recorder is then exposed to anyone who scans for it, and scanning for it is automated and constant. Combine that with default credentials or firmware that has not been updated since installation and the outcome is well documented. If a system was set up this way and the password was never changed, assume it is known.
The better options
A manufacturer relay service, where the recorder makes an outbound connection to the vendor and your app connects through that. Nothing is exposed inbound. This is what most current systems do by default, and for most buildings it is the right answer. It does mean trusting the vendor, which is a reason to care which vendor.
A VPN into the site, so the phone is effectively on the local network and the cameras are not exposed at all. This is the strongest option and the least convenient, which is a fair summary of most security trade-offs.
What to do regardless of which you choose
Change every default password, including on the cameras and not just the recorder. Give each person their own login rather than sharing one, so access can be removed when somebody leaves. Keep firmware updated, because camera firmware updates are overwhelmingly security fixes. And turn off remote access features nobody is using.
Test it before you need it
Remote access should be tested at handover on the phones that will actually use it, not on the installer’s laptop. The common failure is not that it does not work, but that only one person ever had it working and they no longer work there.
Who should have access, and to what
Remote access tends to be set up as all or nothing, which is rarely what anyone wants once they think about it.
Most systems allow different levels: live view only, live plus playback, playback plus export, and full administrative control. A duty manager probably needs live view. Someone investigating an incident needs playback and export. Very few people need to change the configuration, and that account should be separate from the one anybody uses day to day.
It is worth writing down who has what, because access lists grow. Contractors get added for a job, temporary staff get an account, and none of it gets removed unless somebody owns the list.
There is also a privacy dimension worth being deliberate about. A camera system that any member of staff can watch from home is a different thing from one a named person consults after an incident, and employees notice which of the two they are working under.
Remote access gets tested at handover on the phones that will actually use it, which is part of how Elite Security finishes a job. More in the blog, or start with commercial CCTV.