How to choose a way to record work on screen

Tools that record on-screen work, such as session recording, differ in what they capture and who can see it. Decide first what the records are for. Then check, in order: how much to record, in what form, how long to keep it and who sees it, how to tell people, and what it costs.

What the records are for

There are three common uses, and each asks something different of the records.

To report on work to a client or your own management, you need records you can pull by person and period. They also need to be in a form the reader can follow. Each month’s report shows who did what and when. What such a report usually covers is in Reporting your work in client accounts to the client.

To investigate an incident, you need to search by date, person and account. The records also have to still exist when the incident comes to light. NIST SP 800-53 Rev. 5 control AU-11 ties the retention period to supporting investigations after the fact.

For an audit, the records have to tie each action to a person and a time and stay protected from change. They also have to be kept for the period you set and checked by someone other than the admins. These conditions are explained in What’s the difference between an audit log and audit evidence?

How much to record

Recording tools cover one of three scopes: the whole computer, everything in the browser, or only the services you choose. The wider the scope, the more work it captures, and the more personal or unrelated screens slip in.

Pick the scope by where the work you need to see happens. If the work happens entirely in web apps, the browser or chosen services are enough. Whole-computer recording makes sense only when you also need desktop work, such as spreadsheets saved locally. On a personal computer, whole-computer recording also captures the owner’s private life.

Check one more thing: whether each record points to one person. Tools that label records with the service’s login name show only the account name when several people share a login. Ask how a tool ties a record to a person: by the service login, by sign-in to the computer or browser, or by its own identity check.

Video or text

Video shows what was on screen and in what order things happened. To review it you have to play it, and you can’t search it. A text log of actions, such as pages opened, buttons pressed and fields filled in, lets you filter by date or person. It doesn’t show what the screen displayed. Some teams keep both and search the text to find the moment worth watching.

Either way, the recording holds whatever was on screen and whatever was typed. Record a screen showing customer data, and the recording holds that data. NIST SP 800-92 warns that logs can capture passwords and email content. AWS recommends typing passwords with commands that don’t display them, because its session logs keep what’s typed. So check whether a tool can mask password fields, and protect the recordings as carefully as the data in them.

Watching video at normal speed takes as long as the work did. Tools that summarize recordings in text cut that time. A summary can leave things out or get them wrong, though. Use it to decide where to look, and check anything that goes into a report or an incident finding against the original. When you evaluate a tool, see whether each line of the summary links to the matching moment in the recording.

How long to keep it and who can watch

AU-11 leaves the retention period to you, set by your records retention policy. SP 800-92 says log management goals should balance risk reduction against the time and resources they take. In practice, an investigation needs records that last until an incident is noticed, and an audit needs them to last until the next audit. Check that you can set the period yourself and export records before they expire.

Control AU-9 asks you to protect audit records from unauthorized access, change and deletion. Its enhancements add more. Store records on a system separate from the one being recorded, so a break-in there doesn’t reach them (AU-9(2)). Let only a few privileged people manage logging (AU-9(4)), and give read-only access where you can (AU-9(6)). SP 800-92 suggests having someone other than the system’s admin review its logs, so the admin is accountable too. When you compare tools, ask where recordings are stored, whether you can limit who views them, and whether the admins’ own activity is recorded for someone else to check.

How to tell people

AU-14 says to plan session recording with legal counsel, and to weigh what it may reveal about people. Several states also require notice. New York requires written or electronic notice on hiring that the employee acknowledges, plus a posted notice. Connecticut requires prior written notice of the types and locations of monitoring. Since October 1, 2026, new hires must also get, before they start, a written plain-language statement of which prohibited activities may be monitored without notice. Delaware accepts either a notice each day the employee uses company email or internet, or a one-time notice the employee acknowledges. The details and exceptions are in the table in What is session recording?

A tool can help with this, but it doesn’t give the notice your state requires for you. Check whether the tool shows people that recording is on before it starts. Decide in writing what you record, why, who may watch, and how long you keep it, and give that to employees.

Storage and cost

Storage grows with the number of people recorded, the hours recorded each day, and the retention period. For the same hours, video takes more space than a text log. Vendors price differently, by user, by recorded hours, or by storage. Give each vendor your headcount and retention period and ask for a quote.

How narrowly you can aim the recording also drives cost. A tool that records only the accounts and hours your use needs keeps both storage and review time down.