CCTV STQC and BIS certification for government procurement in India

What do the STQC and BIS requirements for CCTV cameras require?

They require an IP (Internet Protocol) CCTV camera to pass a security test against Essential Requirements set by MeitY (the Ministry of Electronics and Information Technology), on top of the electrical safety test it already needed for registration with the Bureau of Indian Standards (BIS). The security test is done by STQC, a directorate of MeitY, or by another agency MeitY notifies.

Two rules carry the requirement, and they work differently. The first is a notification under the Public Procurement (Preference to Make in India) Order 2017, often shortened to PPP-MII or PPO. It governs what government buyers may procure. The second is an amendment to the Electronics and Information Technology Goods (Requirements for Compulsory Registration) Order, 2021, the CRO, under which BIS runs its Compulsory Registration Scheme (CRS). It governs which products can be registered at all.

Before 2024, a CCTV camera or recorder needed BIS registration against IS 13252 (Part 1):2010, a safety standard for information technology equipment. The 2024 changes added cybersecurity to that product safety route.

When did each rule take effect, and which dates moved?

The procurement rule took effect on 7 June 2024, and the registration rule took effect on 9 April 2025 after MeitY extended it once by six months. MeitY's circular of 4 February 2026 confirms both effective dates.

The registration rule, S.O. 1652(E) of 9 April 2024, applied on the expiry of six months from publication, which was 9 October 2024. On that date MeitY issued S.O. 4378(E), extending the implementation date to 9 April 2025 because industry had asked for more time. BIS then told existing licensees that models not complying after 9 April 2025 would be deleted from the scope of their licence.

What do MeitY's Essential Requirements test?

The Essential Requirements test whether a camera can be tampered with, accessed or altered by someone who should not have access. MeitY's notification sets out five broad requirements: physical security through tamper-resistant enclosures, access control through authentication and role-based access, network security through encrypted transmission, software security through regular updates, disabled unused features and strong passwords, and penetration testing.

The key test areas named by MeitY are exposed network services, device communication protocols, physical access to hardware debug ports such as UART, JTAG and SWD, whether memory and firmware can be extracted, the security of the firmware update process, and how data is stored and encrypted. The detailed schedule also asks the maker for documents, such as the datasheet of the system-on-chip (SoC) used in the camera.

Testing is done per product series. MeitY's series guidelines, published by BIS on 22 October 2024, require every model in a series to share the same SoC and identical firmware with matching hash values. If a maker uses several firmware versions, each is tested as a separate series. For a buyer, the practical point is that the firmware version on the certificate matters.

Do the rules cover analogue cameras, NVRs and DVRs?

Analogue cameras are exempt from the security Essential Requirements, but still need BIS registration for safety. BIS's circular of 1 April 2025 records MeitY's clarification of 12 March 2025, and says that from 9 April 2025 analogue cameras are registered against IS 13252 (Part 1) alone, while all other CCTV cameras need IS 13252 (Part 1) plus the security Essential Requirements.

For recorders the position is narrower. The CRO amendment of 9 April 2024 added the security requirement to the entry for CCTV camera. The procurement notification of 6 March 2024 covers network video recorders (NVRs) and digital video recorders (DVRs) for local content, but said that security norms for DVRs and NVRs would be notified later. This article does not state whether those norms have since been notified; a buyer who needs recorders covered should check the current MeitY and BIS position and write the requirement into the tender directly.

What does the Make in India procurement order add for CCTV?

The procurement order requires government buyers to give purchase preference to locally manufactured video surveillance systems, and sets out how local content in cameras, NVRs and DVRs is calculated. The Class-I and Class-II local supplier definitions come from the Department for Promotion of Industry and Internal Trade (DPIIT) order of 16 September 2020.

MeitY's notification also says it applies to procurement by States and local bodies under Central Schemes and Centrally Sponsored Schemes where the project is fully or partly funded by the Government of India. That brings many municipal and city projects within scope.

• At bid stage, the local supplier self-certifies that the item meets the minimum local content, and states where the value is added
• For procurement above Rs 10 crore, the supplier provides a certificate of local content from its statutory or cost auditor, or from a practising cost or chartered accountant
• Complaints about a local content claim are referred to STQC, which is to dispose of them within four weeks
• The complaint fee is Rs 2 lakh or 1% of the value of the products being procured, whichever is higher, up to Rs 5 lakh
• A false declaration is a breach of the Code of Integrity under the General Financial Rules and can lead to debarment

What do government buyers now ask for in a CCTV tender?

Government buyers now ask for proof of BIS registration with the security Essential Requirements, a current STQC security test report, and local content evidence under the procurement order. MeitY's advisory of 11 March 2024 adds a set of security and design expectations that many tenders now copy in.

• BIS registration number for each camera model, with the security Essential Requirements included in the scope of the licence
• An STQC security test report or certificate that is less than three years old and names the offered model and firmware
• Safety compliance to IS 13252 (Part 1):2010, or to IS/IEC 62368-1:2023 as makers migrate
• Local content self-certificate, and an auditor's certificate above Rs 10 crore
• Performance parameters set using the BIS Blank Detail Specification for IS 16910, which MeitY's advisory names for CCTV performance
• Storage of video from government establishments and public places within India, including on cloud platforms, as MeitY's advisory asks
• Avoidance of brands with a history of security breaches and data leaks, which MeitY's advisory also asks for
• Network isolation, changed default passwords, firmware updates and restricted remote access through the maintenance period

How can a buyer check a camera's compliance?

A buyer can check the registration on the BIS Compulsory Registration Scheme portal, which lets anyone search a registration by its R-number, and should match the model and firmware against the security test report. BIS has also published a list of registrations and models of CCTV cameras complying with the security Essential Requirements.

STQC's own list of network cameras certified for the procurement order is no longer updated and is kept for historical reference, because MeitY's circular of 4 February 2026 made the single STQC report under the CRO serve both purposes. BIS's guidelines of 22 October 2024 also allow compliant models to carry the line 'This CCTV camera complies with Essential Requirement(s) for Security' on the packaging.

The safety standard is also moving. MeitY's notification S.O. 4997(E) of 29 October 2025 made IS/IEC 62368-1:2023 supersede IS 13252 (Part 1):2010 under the CRO. BIS's guidelines of 9 March 2026 allow both to run until 1 November 2028, after which IS 13252 (Part 1) stands withdrawn for these products. Where moving a registered camera to the new safety standard affects its security compliance, the maker must submit fresh security test reports as well. A tender running past 2028 should accept both standards now and require IS/IEC 62368-1:2023 after that date.