STQC Certification and CCTV

 STQC Certification and CCTV

CCTV is everywhere now, in metro stations, campuses, warehouses, and housing societies. With that spread comes a tougher question: can you trust what’s on the pole? The government wants a clear “yes”, which is why it’s pushing the market towards standardized, secure-by-design products. The big lever is STQC security certification. It’s not a nice-to-have anymore; it’s the new gate. Manufacturers, integrators, buyers, everyone’s playbook changes in 2025.

STQC, short for Standardization Testing and Quality Certification, is overseen by the Ministry of Electronics and IT (MeitY). Think of it as a seal that says, “This device was built properly and hardened against common attacks.” For surveillance, that covers cameras, DVRs, and NVRs. It looks at product quality, cybersecurity controls, and how data is handled. In other words: fewer soft spots, fewer nasty surprises once the kit goes live.

The Mandatory Requirement

Two dates matter. First, in June 2024, government buyers started insisting on STQC-aligned equipment. Only STQC-certified CCTV products are meant to be sold and integrated in India. No carve-outs for OEMs or import labels. No “we’ll update it later”. If it isn’t certified, it shouldn’t be on the invoice. Simple as that.

As of April 9, 2025, STQC certification is mandatory for all CCTV cameras manufactured, imported, or sold in India. 

·        Government Procurement: Mandatory since June 6, 2024. Any "Made in India" CCTV procured for government projects must strictly adhere to STQC-certified standards.

·        General Market: All IP-based CCTV cameras must comply by the April 2025 deadline to remain legally available for sale.

·        Full Enforcement: From April 1, 2026, no sale of non-compliant CCTV cameras will be allowed, as the previous transition relaxations have been formally withdrawn

Why STQC is mandatory for CCTV?
The Ministry of Electronics and IT (MeitY) made STQC (Standardisation Testing and Quality Certification) mandatory for CCTV systems to ensure:
🔹 Quality & Safety: Cameras must work well and be safe for public use.
🔹 No Spying Risk: To avoid hidden risks like data leaks or spying through poor-quality or foreign-controlled cameras.
🔹 Trusted Performance: STQC checks that the camera meets Indian government standards before it’s used in sensitive places.

✅ STQC = Government-approved safety and quality check for CCTV.

Key Requirements for STQC Certification

This mandate pulls the industry toward “secure by default”. Expect the following to show up in specs and test reports:

·        Secure boot and firmware verification so tampered code can’t sneak in.

·        No default or hardcoded passwords; each device has its own credentials.

·        TLS 1.2+ is a modern way to encrypt streams and management communications.

·        Access restrictions that are quite specific for local and remote logins, together with roles and logs.

·        BIS safety compliance (IS 13252 / IEC 60950-1) where applicable.

·        Chinese-origin OEMs are not eligible for STQC certification.

·        Independent testing at STQC-recognized labs, with proper documentation.

Yes, it’s technical. But it’s also practical. Locked ports. Signed updates. Patch paths that don’t open new holes. That’s how fleets stay healthy.

Who Needs to Comply with This Mandate?

Short answer: the entire chain.

·        Manufacturers, Indian and international, are bringing models to market.

·        OEM partners and importers are rebranding or expanding their ranges.

·        Distributors, retailers, and system integrators are selling or installing systems.

·        Buyers in public projects, smart cities, critical infrastructure, and enterprise.

If you touch CCTV in India, compliance isn’t an afterthought. It’s part of the offer.

What Happens If You Don’t Comply?

Doors close. Non-STQC products become out of bounds for sale and use. You risk being tossed out of tenders. Licenses and approvals can be questioned. Private buyers, especially corporate security teams, will quietly pass. And the reputational hit from a failed audit? That lingers. Why roll the dice when the rules are crystal clear?

Benefits of Using STQC-Certified CCTV Products

In short, here’s what that certification delivers in everyday operations.

·        Stronger cybersecurity out of the box; fewer field incidents, fewer emergency call-outs.

·        Buyer confidence, procurement checks get easier, especially in regulated sectors.

·        Policy alignment with Make in India and Atmanirbhar Bharat priorities.

·        Lower legal and operational risk, plus a smoother path through audits and renewals.

Certification Process for Manufacturers

To obtain the STQC Certificate for CCTV, companies must follow a structured procedure: 

1.   Technical Construction File (TCF): Submit a dossier detailing architecture, firmware versions with hash values, and Bill of Materials (BoM) down to the SoC level.

2.   Lab Testing: Samples are sent to BIS-approved or STQC-recognized labs for functional and cybersecurity stress tests.

3.   Factory Audit: STQC authorities may inspect manufacturing facilities to verify quality control and secure engineering processes.

4.   Labeling: Certified products must display: “This CCTV camera complies with Essential Requirement(s) for Security” on their packaging.

Essential Security Requirements (ER 01:2024)

The Standardisation Testing and Quality Certification (STQC) Directorate validates cameras against Essential Requirements (ER). These are not optional features but mandatory engineering controls: 

·        No Hardcoded Passwords: Each device must have unique credentials; "admin/admin" defaults are prohibited.

·        Secure Boot & Firmware: The camera verifies its own software integrity every time it starts up. Only cryptographically signed firmware can run, so nobody can inject malicious code.

·        Encryption: Mandatory use of TLS 1.2+ for streaming and management data to prevent interception.

·        Physical Security: Requirements for tamper-resistant enclosures and locked physical ports (like UART or JTAG).

·        Data Sovereignty: Prevents sensitive surveillance data from being transmitted to unauthorized foreign servers. Manufacturer debugging interfaces must be shut down before the camera leaves the factory. Open debug ports are one of the most common entry points for hackers.

·        Vulnerability disclosure policy – Brands must maintain a formal process for reporting and patching security flaws. This means ongoing accountability, not just a one-time test.

·        Supply chain transparency – Manufacturers must declare the origin of chipsets, PCBs, and processors. Think of it like ingredient labelling on food; now the government checks where your camera's brain comes from.

Impact of Non-Compliance

Failure to meet these standards results in significant market restrictions:

·        License Cancellation: Existing BIS licenses may be suspended or cancelled.

·        Customs Delays: Imported units lacking certification are often stalled at ports.

·        Tender Disqualification: Non-compliant brands are excluded from lucrative smart city and public infrastructure projects

How to Verify a Specific Model

Certification is awarded at the model level, not just the brand level. You can verify a specific camera by: 

1.   Checking the Packaging: Look for the mandatory text: "This CCTV camera complies with Essential Requirement(s) for Security".

2.   Official Portal: Visit the STQC Certified Products List and search by manufacturer name or certificate number.

Understanding BIS ER Approval

Until recently, a CCTV camera only needed to pass a basic electrical safety test (IS 13252) to be sold in India. That test checked whether the camera was safe to plug in: protection against electric shock, insulation, and fire hazards. That's it.

Alongside STQC, BIS ER (Bureau of Indian Standards – Electronics Registration) approval is another essential regulatory requirement for electronic surveillance equipment sold in India. 

The BIS ER approval indicate strengthens trust among distributors, channel partners, and enterprise buyers who prioritize regulatory compliance during vendor evaluation.

What BIS ER Approval Ensures

·        Conformity to Indian safety standards

·        Electrical safety compliance

·        Product testing through recognized labs

·        Mandatory registration before market sale

Key Aspects of BIS-ER-01 Certification

·        Objective: Adds a mandatory cybersecurity layer to existing electrical safety standards for IP cameras and security equipment.

·        Mandatory Status: Essential for legal sale or import of surveillance products in India.

·        Testing Focus: Evaluates debug interfaces, password complexity, and access controls.

·        Deadline/Timeline: The deadline for implementation was April 9, 2025.

·        Application: Often involves collaboration with BIS-designated labs for testing and submission through official channel

BIS guidelines are listed below to comply with the Essential Requirements for CCTV Cameras. 

While some of it may sound complicated, not to worry, we are here to simplify it for you.  Email us or call us – we are happy to discuss and guide you 

·        Existing licensees of ‘CCTV Cameras’ as per IS 13252 (Part 1) : 2010/ IEC 60950-1 : 2005 

o   Existing licensees of CCTV Cameras shall apply online through the “Apply for Standard Revision/ Amendment/ Essential Requirement” module along with test report for ER: 01.

o   Applicable Fees: 

§  Inclusion test report: INR 30,000/- + applicable taxes per test report 

§  Additional test report: INR 20,000/- + applicable taxes per test report 

o   All non-compliant models shall be deleted from the scope of License and registration shall be liable for cancellation after 09 April 2025.  

·        New Applicants of CCTV Cameras: 

o   Applications for CCTV Cameras may be submitted along with test report for ER: 01 in addition to test report as per IS 13252 (Part 1): 2010. 

o   Processing of Applications without test report for ER: 01 shall be permitted only upto 09 April 2025. 

o   In case of above point no. 3 (B) (ii), a declaration from the applicant will also be required to submit that they will implement the revised Standard by 09 April 2025. 

o   Beyond 09 April 2025, above point no. 3 (B) (ii) will not be valid and registration will not be granted to such applications which are not complying with ER: 01 

·        Change in Scope of License:

o   Inclusion applications for CCTV Cameras may be submitted along with test report for ER: 01 in addition to test report as per IS 13252 (Part 1): 2010. 

o   Processing of Applications without test report for ER: 01 shall be permitted only upto 09 April 2025. 

o   In case of above point no. 3 (C) (ii), a declaration from the applicant will also be required to submit that they will implement the revised Standard by 09 April 2025. 

o   Beyond 09 April 2025, above point no. 3 (C) (ii) will not be valid and registration will not be granted to such applications which are not complying with ER: 01. 

o   Existing Licensees shall not use the Inclusion module to apply for implementation of Essential requirements of registered models. Instead, they may use the module as already mentioned in 3 (A)(i). 

·        Models complying with the above Order may display the following on the packaging: “This CCTV camera complies with Essential Requirement(s) for Security”.  

·        Provision for generating Test Request for ER for Security of CCTV– ER: 01 has been made live on BIS Portal. 

STQC vs BIS ER – Which One Do You Need?
In today’s regulatory environment, certifications are not just about compliance—they’re about trust, credibility, and market access. Two certifications that often create confusion are STQC (Standardisation Testing & Quality Certification) and BIS ER (Bureau of Indian Standards – Essential Requirements). While both deal with product quality and safety, their application areas and target customers differ significantly.

STQC (Standardisation Testing & Quality Certification)
 • Primary Customers: Government departments, PSUs, and organizations working on e-Governance, IT infrastructure, and software/hardware systems.
 • Focus: IT systems, biometric devices, smart cards, e-sign, and other digital infrastructure components.
 • Why It’s Needed: Many government tenders and projects mandate STQC certification to ensure reliability, interoperability, and adherence to national security/quality standards.

BIS-ER ( Bureau of Indian Standards – Essential Requirements)
 • Primary Customers: Private manufacturers, importers, and businesses selling electronic/IT products in the Indian market.
 • Focus: Consumer electronics, IT equipment, household gadgets, and other electronic products listed under the Compulsory Registration Scheme (CRS).
 • Why It’s Needed: BIS ER is mandatory for commercial sale in India—without it, businesses cannot legally sell or market their products.

In simple terms
 • Government Projects → STQC Certification (trust + compliance in IT/e-governance ecosystem).
 • Market Access (Retail/Commercial) → BIS ER Certification (legally required for selling electronic products in India).

From Today onwards (April 1, 2026): what changes

The government gave the industry time to prepare. New BIS licences without ER-01 compliance stopped being issued from April 9, 2025. Brands that didn't get certified could sell existing warehouse stock for a while, but that grace period is now over.

From April 1, 2026, selling a non-compliant camera in India carries fines of up to 10× the product's value and up to 2 years in prison. BIS is already raiding warehouses.

Existing cameras already installed in your home or office are unaffected. The rule targets new sales, not existing use. And analog cameras are exempt; this applies only to IP (network-connected) cameras.

How to set up a network camera

How to set up a network camera (a.k.a. IP amera

Network cameras (a.k.a IP cameras) are gaining popularity rapidly among consumers due to their ever-improving quality, features and declining prices. Traditional typical users of network cameras are enterprises that have professionals for installation and maintenance. Many consumers choose the DIY approach to set up their cameras. This article is meant to help these users. It by no means can replace the help from professionals that is needed for a variety of reasons – complexity of a video surveillance system, user lacking required basic computer/network knowledge, demanded expedition…

There are literally thousands of models of network cameras in use. It is impossible to have a set of instructions fitting every model perfectly. We use a popular model (M1034-W) by the network camera inventor – Axis – in this article. The setup steps for the vast majority of other network cameras are either identical or very similar to the ones described here.

A word about ONVIF. Detailed explanation about ONVIF is beyond the scope of this article. An average user may only need to know that ONVIF is an international standard. An ONVIF conformant camera offers the maximum compatibility and interoperability with many software and hardware on the market. Generally speaking, ONVIF conformant cameras have more features and better quality than traditional non-ONVIF network cameras.

Network configuration

Network cameras are different from web cams and analog CCTV cameras. Web cams are connected to computers by USB cables. Analogy CCTV cameras are connected to servers by coax cables. Network cameras are connected to a network for access just like computers are connected to networks. Each network camera is actually a computer with a CPU and memory. I process images from CCD (Charge-coupled Device) or CMOS (Complementary Metal-oxide Semiconductor) sensors, send to clients (e.g. apps) and hosts a web server.

1.    Connect the network camera to your Local Area Network (LAN). A LAN is often the home network of a consumer. Plug an Ethernet cable (a.k.a. Cat 5 cable) into the Ethernet socket of the network camera, then plug the other end to the router (a.k.a. gateway or access point).

If this network camera does not have Wi-Fi, this may be the only step needed for the network configuration.

2.    Find the IP address of the network camera. There are a few ways to do it.

o   Use a utility program from the camera’s vendor to find the camera. Please make sure Dynamic Host Configuration Protocol (DHCP) is used for now to ensure the network camera obtains an appropriate IP address from the router. 
The following is from AXIS IP Utility:

 

The following is from IPCSearch for the generic network camera:

o   For ONVIF cameras, you can run an ONVIF client application to discover the camera. The following are from Onvifer for Android, IP CENTCOM for Windows 10 and 11or IP CENTCOM for Windows Phone.

o   Use your router’s configuration page to find the camera’s assigned IP. You can unplug, then plug in the Ethernet cable to see which device shows up on the list to determine the device’s IP. The following is an example:

3.    Configure Wi-Fi. Use a browser to visit the camera’s web UI with its IP address and port (e.g. http://192.168.0.20:81). Please note that if the camera uses the default HTTP port 80, you do not need to specify the port in the web address. Some cameras uses a different port for HTTP (e.g. the generic network camera referred to in this article uses port 81). 
The following two sets of screenshots show the Wi-Fi configuration pages of an Axis network camera and a generic network camera respectively:

 

 

 

4.    Fix the IP address (i.e. make the IP address static). Since the IP address is dynamically assigned, it may change after a power cycle of the network camera or the router. Many routers try to use the same IP address for a device by default, but you should not rely on this for fixing the IP address. There are two ways to achieve this:

1.    Configure then network camera to turn the dynamically assigned IP address to a static IP address. 
You can use a utility program to do this.
The following is from AXIS IP Utility:

The following is from IPCSearch for the generic network camera:

You can also use the network camera's web UI. 
The following is from the Axis camera's web UI:

The following is from the generic network camera's web UI:

5.    Start using the Wi-Fi. Unplug the Ethernet cable, move the camera to your desired location (unplug and plug in the power cable if needed).

6.    Find the new IP again. Some network cameras obtain new IPs for Wi-Fi different from the ones for wired connections. You may need to know new IP for configuration.

Enable ONVIF Services (for some models of Axis).

Some ONVIF cameras (e.g. some from Axis) have ONVIF services disabled by default. You will need to enable ONVIF as shown by the following figures for Axis 1031-W:

 

Axis cameras require a set of users for ONVIF services different from that for other types of access (e.g. web UI, proprietary API). It is critical to add users for ONVIF services because these cameras have no users for ONVIF services by default. The following figure shows how to add ONVIF users.

Configure Apps

Most users want to access their network cameras outside their LANs (e.g. outside their homes). The next section will explain how to access the cameras via Wide Area Network (WAN) (e.g. via cellular connections). Unless you are experienced with the camera and its configuration, it is extremely important to make sure the camera works on your LAN first. This is because the WAN access will never work if the LAN access does not work. If it works on your LAN, it will be very easy to diagnose any issues with the WAN access.

Many apps have automated the setup process to a great degree, and it usually takes less than 1 minute to set up a camera before starting enjoying its video.

The following is for setting up a camera with apps Onvifer for Android, and IP CENTCOM for Windows 8.1/10 and Windows Phone.

The first step is choosing the type of device for the configuration as shown by the following figure:

ONVIF is the recommended one. Almost all new modern network cameras are ONVIF conformant. Please note most ONVIF cameras can also be used as generic RTSP stream or generic MJPEG. Older network cameras support RTSP, MJPEG, or both.

Once the type is selected, input the few required parameters (e.g. user name, password), the setup will usually be completed in seconds. The following figures show the setup screens for Onvifer, IP CENTCOM for Windows Phone and Windows 8.1/10 respectively:

Configure WAN Access (i.e. Remote Access)

Most users want to access their network cameras outside their LAN (e.g. home network). They may access via a cellular connection, a Wi-Fi hotspot, workplace network, etc. We have received far more questions about this topic than any others.

If you happen to use one of our apps, you can click button WAN Access after the video test on the setup screen is finished successfully as following figures show for Onvifer for Android, and IP CENTCOM for Windows and Windows Phone respectively:

You will get specific step-by-step instructions for the configured network camera as following:

We hope you will read the following to gain fundamental understanding of WAN access configuration regardless of whether you use our apps. It may look daunting to configure the WAN access, but it actually takes only a few minutes to do it once you know how. This section may be a bit long because we try to help you understand the principles behind the process. The specific steps highly depend on your camera and router.

Please note that most instructions here regarding configuring WAN access are NOT specific to our apps. They are applicable no matter which app (including browsers) you use to access your device remotely unless you use technologies such as P2P that maintain a constant connection between your camera and a server of a company that is usually unknown to users.

Let us have some basic understanding of how network cameras are accessed first. Every network camera has an IP address (e.g. 192.168.0.100) on a LAN. Non-technical users can treat this IP address as a street address, and their LAN (e.g. home network) as a city. Every computing device on your LAN can find the network camera by its IP address, just like everyone in your city can locate a home by its street address.

A network camera may use more than one port (the default port is HTTP default port 80). Each port offers a unique service. For example, one port for web UI, one port for RTSP. Non-technical people can treat ports as doors of a home. You get different services by entering different doors.

The IP address of a network camera is a private IP. The most common range is 192.168.0.0 - 192.168.255.255, followed by 10.0.0.0 - 10.255.255.255. They are least likely in the private IP range of 172.16.0.0 - 172.31.255.255. Private IPs are good for a LAN. It is like that a street address "101 5th Avenue" is good for locating a home in a city, but you cannot use it to locate a home in another city because every city may have "101 5th Avenue". Every LAN may have a device using a private IP address such as 192.168.0.101.

Now, we can talk about how to access a network camera outside its LAN, or access a home outside its city.

Each LAN is behind a router (or gateway), and the router has an IP address and that IP address is public IP address, not a private IP address like that of a network camera though the IP address's format is the same. Since it is a public IP, the router can be accessed on the Internet anywhere in the world. How do we tell a router that we want to communicate with a specific network camera on the LAN behind it? The trick is port forwarding.

The only way to access a computing device on a network is through its IP address and ports. If there is only one network camera on a LAN, we can ask the router to forward everything to the camera, and everything will be the same as accessing the camera on the LAN except using the public IP address of the router. This would not work for multiple network cameras.

To deal with multiple cameras, we need to allocate different ports for different cameras. In other words, you will access every network camera with exactly the same IP address - the public IP address of the router, but with different ports. Using the city analogy, you will send/request packages to different homes of a city by using its different doors. For example, doors 8080 and 5556 of the city to doors 80 and 556 of address 101 5th Ave, doors 8082 and 5558 of the city to doors 80 and 556 of 102 5th Ave, and so on.

Most cameras allow modifying its used ports. Port 80 is usually used for HTTP and ONVIF, and port 554 is used for RTSP. Though it is not necessary theoretically, it is the best to change a camera's ports to match their external forwarding ports. For example, if port 8080 is forwarded to a camera's HTTP port, it would be the best to change the camera's HTTP port to 8080; if port 5554 is forwarded to a camera's RTSP port, it would be the best to change the camera's RTSP port to 5554. The following two figures show how to configure port forwarding for multiple cameras after modifying their ports to match the external ports.

 

Some cameras do not allow the modification of their ports, in this case you can forward different external ports to the fixed ports of cameras, but it is critical to tell apps to overwrite the RTSP ports informed by the cameras with their corresponding external RTSP forwarding ports (e.g. 5554, 5556…) in apps. This is because the cameras are not aware of port forwarding, so they always tell apps to use their ports. All of our apps support RTSP port overwriting. The following figure shows the port forwarding configuration of this scenario.

Each router has its own port forwarding UI. All of them have the same pattern - each port forwarding entry allows forwarding one port or a range of ports from the router (called external or public) to one port or a range of ports of a device.

The following is the port forwarding page of Netgear N300 Wireless Gigabit Router WNR3500Lv2, a popular low cost router. It represents the simplest port forwarding UI

The following represents a more complex port forwarding UI from Quantum Gateway (Fios-G1100). It shows that port 60163 is forwarded to port 80 of an Axis camera following the WAN access instructions of our app. Other ports can be forwarded in exactly the same way.

1.    Enter router web UI > Firewall > PortForwarding > Select the Axis camera 192.168.1.163 > Custom Ports > Advanced

2.    Protocol: Both > Source Ports: Any (i.e. you do not care which port the connection is from) > Destination Ports: Specify 60163 (i.e. the port reached by a remote connection) > Forward to Port: Specify 80 > Schedule: Always > Add+

3.    A port forwarding entry for this Axis camera is added to the list:

All network cameras of major brands use one port for everything - Web UI, ONVIF services, RTSP and snapshot because they use only one transport protocol - HTTP. They support RTSP over HTTP. Some cameras, especially many made in Shenzhen, China require up to three ports - one port for web UI and maybe snapshot, one port ONVIF services, and one port for RTSP.

Finding the required ports sometimes is a bit tricky. Fortunately, all of our apps list the required ports as shown by the following screenshots:

Now you can use your router's public IP address to access your network camera. If you do not know your router's public IP, there are a few ways to find it:

• Use a browser to visit https://www.vpnmentor.com/ipinfo or http://whatismyipaddress.com
• Visit the Internet configuration tab of your router's configuration page.
• Use command "nslookup myip.opendns.com resolver1.opendns.com" in Windows Command Prompt. The address for "myip.opendns.com" is your public IP.

Suppose your router's public IP is 109.173.137.12 and you have forwarded external port 8080 to the camera's ONVIF port 80, you can set up your camera with address 109.173.137.12:8080, and access it anywhere in the world.

Dynamic D