smartcitiesmission.com
Title card: non-compliant CCTV cannot be sold in India since 1 April, from smartcitiesmission.com
City SurveillanceCyber Security

Non-Compliant CCTV Can’t Be Sold in India Since 1 April

Smart City Bot

From 1 April 2026, India’s electronics ministry allows no sale of CCTV cameras that do not conform to the security Essential Requirements it notified in April 2024.[1] Tenders should therefore ask for valid STQC test evidence under those requirements. But our argument is that they should treat that evidence as a floor, not a guarantee: a certificate describes one hardware and firmware build at one point in time, and it says nothing about how that camera is installed, configured or patched over its working life.

This article sets out the timeline, what the requirements test, what a certificate does and does not cover, and ten checks a bid evaluator can apply. It relies on the government documents listed under Sources. We have read each one; we have not read the Gazette notifications themselves, and we make no claim about any manufacturer’s products.

The ban took two years to arrive, with one extension for old stock

DateWhat happenedSource
6 Mar 2024MeitY notifies CCTV cameras under the Public Procurement (Preference to Make in India) Order, with Essential Requirements (ERs) for security[2]
9 Apr 2024Gazette notification adds the ERs to the Compulsory Registration Order (CRO), alongside the existing safety standard IS 13252 (Part 1)[2][1]
7 Jun 2024The Make in India order’s requirements take effect[2]
22 Oct 2024BIS issues implementation guidelines. Existing licensees must comply for their models by 9 April 2025, and non-compliant models are then deleted from the licence scope[4]
9 Apr 2025CRO requirements take effect[2]
21 May 2025A MeitY memorandum allows sale of cameras imported or made before 9 April 2025, to clear stock (we cite it only through the January 2026 memorandum, and have not read it)[1]
16 Jan 2026MeitY withdraws that relaxation from 1 April 2026. No sale of cameras that do not conform to the ERs is allowed from that date[1]
4 Feb 2026MeitY clarifies that STQC will issue ER test reports under the CRO, which also serve the Make in India order[2]
25 Mar 2026In a Lok Sabha reply, the government says 507 camera models are certified for compliance with the ERs, and that government departments are restricted from buying equipment that does not meet them[3]
Dates as stated in the cited MeitY, BIS and PIB documents.

Note what the January 2026 memorandum covers: sale. We found nothing in these documents on penalties, on who enforces the sale ban, or on cameras already installed. We therefore do not say what happens to an installed camera that was sold before the cut-off.

The requirements test thirty things, and most of them sit inside the camera

BIS’s laboratory register lists the test as ER 01 (2024), with 30 clause-level line items.[6] They fall into four groups: nine on hardware and device security (for example debug-interface protection, device-unique keys, secure storage, tamper protection, boot-image validation), twelve on software (for example memory protection, data-in-transit security, server connection validation, a software bill of materials, secure code review, code signing, firmware downgrade protection and scheduled updates), five on wireless and supply chain, and four on threat mitigation and supply-chain risk assessment.[6]

The government’s own summary is shorter. It says the origin of critical components such as the System-on-Chip (SoC) must now be documented, devices must be tested against vulnerabilities that allow unauthorised remote access, and testing must be done at accredited laboratories.[3] STQC’s procedure adds that manufacturers file a Technical Construction File with artefacts for each requirement, provide samples or engineering boards with access probes, and demonstrate testing, with the laboratory’s report reviewed by a certification body.[5] STQC also describes the certificate as valid for three years from issue, subject to surveillance audit.[5]

One detail deserves attention from anyone who buys updates. The scheduled-update clause (2.12) asks the vendor to submit an operating procedure for issuing updates, automatic or manual, to devices in the field.[5] It examines the vendor’s process. It does not make the building owner install anything.

A certificate describes one firmware build, and the rules say so

BIS’s series guidelines make the point plainly. Models can share one test only if they use the same SoC, identical security-related PCB layout and the same software and firmware versions “with matching hash values (including Major, Minor and Build versions)”. If several software versions are used, each is tested separately as an independent series.[4] The issued certificate must carry a product picture, model number, chipset details with country of origin, firmware version and hash value, and any deviation must be documented in a differential analysis report.[4]

Our reading is that this puts the firmware hash at the centre of a compliance check. A camera that ships with a different build from the one tested is, on the face of these rules, outside the tested series. It also means a certificate cannot tell an owner whether the version running on the pole today is the version that was tested. Only the owner can check that.

The three-year period is stated for STQC’s test report and certificate.[2][5] The BIS guidelines we read do not give a validity period for the registration itself, so we do not say how long a registration lasts, and we do not equate the two.[4]

What the evidence does not cover is everything that happens after installation

  • The installed camera. Laboratory testing uses production samples or engineering boards.[5] It cannot confirm that the units delivered to site match, or that default settings were changed.
  • The network and recorders. The ERs as notified apply to cameras. Video management software, recorders, switches and cloud services are separate evidence questions.
  • Later vulnerabilities. A certified build can still have a flaw found next year. Whether it gets fixed depends on the vendor’s update process and on the owner applying it. Our article on who patches cameras and building software takes this up. See three advisories, one gap.
  • Stock and dates. The sale ban turns on when a camera is sold. A bid should ask the supplier to show the model, firmware and sale date together.

Ten checks that turn the evidence into a bid-evaluation rule

This checklist is ours, not policy and not part of any MeitY or BIS document. Adapt it to your procurement rules.

  1. Exact model. The BIS letter or registration lists the exact model number offered, not a family name.[4]
  2. Test report and certificate. The STQC or other notified-agency report names that model or its series, and shows issue and validity dates.[2]
  3. Firmware match. The firmware version and hash offered match those on the certificate; any difference comes with a differential analysis report.[4]
  4. Chipset disclosure. The SoC make, model and country of origin are stated.[4]
  5. Software bill of materials. The bidder supplies the software bill of materials for the offered build.[5]
  6. Update procedure. The vendor’s documented update procedure is supplied, with who applies updates, how quickly after a fix is released, and how it is proved.
  7. Remote access and cloud. All cloud, relay or peer-to-peer services the camera uses are disclosed, with default credentials removed before handover.
  8. Sale date. The supplier declares the date the units were sold, so you can see whether the post-1 April 2026 sale rule applies.[1]
  9. Recorders and VMS. Separate evidence is requested for recorders and management software, which the camera requirements do not cover.
  10. Lapse and re-test. The contract says what the vendor must do if a certificate lapses or is withdrawn, and gives the owner a right to ask for re-verification.
Disclosure: this article is based on public government documents. MeitY, BIS and STQC did not review it. The banner below is a promotion for aigence video analytics and is unrelated to the compliance status of any camera discussed.

Looking for smarter, secure-by-design video surveillance? Explore aigence AI Video Analytics.

aigence AI video analytics for video surveillance

Sources

  1. MeitY (via BIS CRS site), Office Memorandum W-18/26/2025-IPHW, Withdrawal of Extension for compliance with Essential Requirements for security of CCTV cameras, 16 January 2026
  2. MeitY, Circular, Clarification on testing requirements under PPP-MII for CCTV cameras, 4 February 2026
  3. PIB, Ministry of Electronics and IT, Government has strengthened the legal framework pertaining to network security and data protection (Lok Sabha reply of 25.03.2026), 25 March 2026
  4. Bureau of Indian Standards, Registration Department, Guidelines for implementation of Essential Requirement(s) for Security of CCTV, with series guidelines, 22 October 2024
  5. STQC Directorate, IoT System Certification Scheme, STQC/IoTSCS/P01, Procedure for CCTV Testing, Evaluation and Certification, Issue 01, 21 May 2024
  6. Bureau of Indian Standards, LIMS, Scope listing for ER 01 (2024) at ETDC (STQC) Thiruvananthapuram, accessed 26 October 2026

Leave a Reply