STQC certification for CCTV cameras is the security testing a camera model must pass before it can be registered with BIS (Bureau of Indian Standards) for sale in India, or bought by government departments. Since 9 April 2025, BIS has not granted any new licence or model inclusion for a CCTV camera unless it complies with the Essential Requirements (ER) for Security of CCTV.
The testing goes well beyond a port scan: labs examine your hardware, firmware, supply chain and, explicitly, your source code. This guide covers the dates, the requirements, the process, the official fee, why models fail and how to prepare.
Key takeaways
- From 9 April 2025, BIS grants no new licence or model inclusion for CCTV cameras without ER compliance. Analog cameras are exempt.
- Two separate notifications apply: one for government procurement (March 2024) and one under the BIS Compulsory Registration Order (April 2024).
- The ER covers four areas: hardware security, software and firmware security, secure process and supply chain, and product development.
- STQC's procedure requires secure code review, both automated and manual, using a licensed static analysis tool, with your team present.
- The official BIS fee is ₹30,000 + tax per application. STQC lab fees are by quotation, and industry estimates put STQC plus BIS at about 7–8 months per model.
- Run your own source code review and VAPT, freeze the firmware, and prepare the SBOM and TCF before you book a lab.
What is STQC?
STQC (Standardisation Testing and Quality Certification) is a directorate under MeitY (Ministry of Electronics and Information Technology). It runs the IoT System Certification Scheme (IoTSCS), an IoT security certification scheme for devices and systems in general, and it publishes the procedure used to test and certify CCTV cameras against the Essential Requirements.
Most of the labs that BIS recognises for CCTV security testing are STQC labs. So "STQC certification" is used loosely for both an STQC Certificate of Approval and the ER:01 security test report that goes into a BIS application.
Two notifications: government procurement vs the BIS CRO
The rules came through two separate legal routes.
- Government procurement (S.O. 1119(E), 6 March 2024). Issued under the Public Procurement (Preference to Make in India) Order, this first set security requirements for CCTV cameras bought by the government. Buyers need a security report from STQC or another MeitY-notified agency.
- BIS Compulsory Registration Order (S.O. 1652(E), 9 April 2024). This amended the Electronics and IT Goods (Requirements for Compulsory Registration) Order, 2021 (CRO). It added the "Essential Requirement(s) for Security of CCTV" to the CCTV camera entry, which was already covered by IS 13252 (Part 1):2010.
Note the difference: IS 13252 (Part 1) is a safety standard, while the ER is a separate security requirement, shown as ER:01 on the BIS portal. A camera under the CRO needs to satisfy both. A MeitY circular of 4 February 2026 reportedly says that one STQC report under the CRO ER serves both the CRO and procurement, and is valid for three years.
Timeline of key dates
| Date | What happened |
|---|---|
| 6 March 2024 | S.O. 1119(E) (Gazette 7 March 2024) set CCTV security requirements for government procurement. |
| 9 April 2024 | S.O. 1652(E) added the Essential Requirements for Security of CCTV to the CRO. |
| 9 October 2024 | Original effective date. S.O. 4378(E), issued the same day, extended it to 9 April 2025. |
| 9 April 2025 | ER compliance became mandatory: no new BIS licence or model inclusion for CCTV cameras without it. |
| 12 March and 1 April 2025 | MeitY clarification and BIS circular exempted analog cameras (self-declaration). |
| 1 April 2026 (reported) | A MeitY OM of 16 January 2026 reportedly ended the relaxation that let cameras made or imported before 9 April 2025 be sold without ER compliance. |
CCTV Essential Requirements: what they cover
STQC's procedure IoTSCS-P01 (Issue 01, 21 May 2024) groups the CCTV essential requirements into four broad areas.
| Area | What it means | Examples of what is checked |
|---|---|---|
| Hardware security | The physical device should not hand an attacker easy access or secrets. | Debug interfaces (USB, UART, JTAG, SWD) disabled or protected; unique keys and certificates per device; secure key storage (TEE, secure element or TPM); tamper resistance; secure boot that validates the boot image signature; cryptographically secure random numbers. |
| Software and firmware security | The code running on the camera should be hard to exploit, tamper with or reverse. | Memory protections (ASLR, DEP); TLS with certificate validation or pinning; banned C functions replaced; an SBOM per firmware; no hard-coded credentials anywhere, including third-party code; anti-reverse-engineering; signed updates with anti-rollback. |
| Secure process | How the device communicates and where its critical parts come from. | Encrypted and authenticated wireless; trusted sourcing of the SoC and critical parts (hardware BOM); supply-chain risk management; any proprietary network protocol declared with implementation details and source code. |
| Product development | How the product is designed, built and packed. | Design documents down to PCBA and SoC level; counterfeit and tainting mitigation; malware scanning before packaging; supply-chain risk and business continuity. |
Testing also covers exposed network services, memory and firmware extraction, data storage and encryption, penetration testing with port scans, and password policies. STQC's supply-chain guidance asks labs to verify SoC and firmware sourcing (invoices), PCBA X-ray images and layouts.
Which products are covered?
The ER applies to CCTV cameras under the CRO. Analog cameras are exempt and need only a self-declaration (MeitY clarification, 12 March 2025; BIS circular, 1 April 2025). For NVRs and DVRs the position is less clear: STQC's IoT scheme places them under its general IoT levels, so confirm the requirement for recorders with BIS or your lab.
STQC certification process, step by step
Based on STQC's CCTV procedure and IoT scheme rules, the STQC testing and certification process runs broadly like this.
- Confirm your route. BIS registration, government tenders, or both.
- Prepare the Technical Construction File (TCF). Your main evidence document, addressing every ER clause.
- Apply and get a lab. Under the STQC scheme, you submit the application and TCF to the STQC certification body, which assigns a test lab. For the BIS route, ER:01 reports come from BIS-recognised labs, listed on the BIS CRS lab page under "ER01".
- Proposal, payment and samples. The lab sends a proposal; you pay and send samples.
- Testing. Witnessed by an STQC assessor, including the secure code review described below.
- Fix and retest. Close any non-conformities.
- Report and certificate. The test report goes to the certification committee, which issues a Certificate of Approval valid for three years, with surveillance. For BIS, the ER:01 report supports your registration or model inclusion.
What you must submit
- A TCF addressing every ER clause.
- ISO 9001 and incorporation certificates, and a compliance declaration by a director.
- Production samples, or engineering boards with access and probes for hardware testing.
- A supply-chain diagram.
- Series details showing models share the same SoC, PCBA, firmware hash and hardware BOM.
- A software bill of materials (SBOM) for each firmware.
- Firmware binaries and your internal code review reports.
Where STQC source code review fits
IoTSCS-P01 explicitly requires "secure code review [both automated and manual] using a licensed static analysis tool". It is carried out with the OEM's team present, in one of three ways: you bring the code to the evaluation agency (the recommended option), you bring your own licensed tool, or the lab gets remote access.
In other words, the lab will read your code. If your firmware has never been properly reviewed, this is where long finding lists and delays begin.
Code-level checks to expect in STQC source code review
| Check | What the lab looks for | How to get ready |
|---|---|---|
| Banned C functions | Unsafe functions replaced with safe equivalents. | Sweep the codebase for unbounded calls such as strcpy, sprintf and gets, and replace them with bounded versions. |
| Hard-coded credentials | No backdoor passwords or keys in any code, including third-party binaries and libraries. | Scan source and binaries for secrets; remove default and shared accounts. |
| SBOM | Third-party components, versions and known vulnerabilities, plus a patch process. | Generate the SBOM from the exact build you will submit and check each component for known CVEs. |
| Secure updates | Code-signed updates with anti-rollback. | Verify signatures on device and block downgrades to older firmware. |
| Debug interfaces | USB, UART, JTAG and SWD disabled or protected in production. | Check both the hardware and the code paths that enable debug consoles or Telnet. |
Want to know how your firmware will fare before the lab sees it? A pre-assessment source code review for STQC covers banned functions, hard-coded credentials, the SBOM and update signing, so you walk into testing with known, fixed findings instead of surprises.
STQC certification cost and timelines
The only official figure published is the BIS fee: ₹30,000 + tax per application, which includes one test report, and ₹20,000 + tax for each additional report. STQC lab testing fees are by quotation and not published. Your own preparation work, such as code review and VAPT, is a separate cost; get a rough figure from our VAPT and source code review cost estimator.
On time, plan for months, not weeks. An industry estimate reported by The Tribune puts STQC plus BIS at about 7–8 months per model. Reuters reported in May 2025 on limited lab capacity, a backlog of applications, source-code scrutiny and retesting after firmware upgrades. Because series details are tied to a firmware hash, a firmware change is likely to need fresh testing, so confirm with your lab before you change anything.
Common reasons CCTV models fail or get delayed
Industry write-ups point to the same problems again and again:
- Default or shared credentials, and unlimited login attempts.
- Telnet or debug ports left open.
- Unsigned firmware or updates without anti-rollback.
- Hard-coded credentials in your own code or in third-party libraries.
- Banned C functions still in use.
- A missing or incorrect SBOM.
- Documentation that does not match the build actually tested.
- A firmware change mid-process, forcing a retest.
Almost all of these can be caught in your own review first.
How to prepare: an STQC readiness checklist
- Do a pre-assessment source code review. Licensed static analysis plus manual review, covering third-party libraries and binaries too.
- Run VAPT on the device, apps and cloud. Exposed services, password policies, firmware extraction, debug access and update security.
- Fix, then retest before you book the lab.
- Freeze the firmware. Record its hash so the tested build, TCF and series details match.
- Prepare the SBOM. Generate it from the frozen build, list known vulnerabilities and document your patch process.
- Write the TCF clause by clause, with design documents to PCBA and SoC level.
- Collect supply-chain evidence. SoC and firmware sourcing invoices, PCBA X-ray images and layouts, the hardware BOM and a supply-chain diagram.
- Get samples ready, plus your internal code review reports.
Xtreme InfoSec is not STQC, is not a BIS-recognised lab and does not issue certificates or test reports. What we do is readiness work: manual and tool-based source code review of firmware and apps (SonarQube, Checkmarx and open-source tools), banned-function and hard-coded-credential sweeps, SBOM and third-party component checks, and device, app and cloud VAPT. You get a gap report mapped to the ER areas and a free retest, so the lab review goes smoothly.
Frequently asked questions
What is STQC certification for CCTV cameras?
It is the security testing of a CCTV camera against the Essential Requirements for Security of CCTV, carried out by STQC or other recognised labs. The result is an ER:01 test report for BIS registration, a security report for government procurement, or an STQC Certificate of Approval under its IoT scheme.
Is STQC certification mandatory for CCTV cameras in India?
For CCTV cameras under the BIS Compulsory Registration Order, yes: since 9 April 2025, BIS grants no new licence or model inclusion without ER compliance. Government buyers also need a security report from STQC or another MeitY-notified agency. Analog cameras are exempt.
Does STQC review the source code of CCTV cameras?
Yes. STQC's procedure requires secure code review, both automated and manual, using a licensed static analysis tool, with the manufacturer's team present. Labs also ask for firmware binaries and your internal code review reports.
How much does STQC certification cost?
The official BIS fee is ₹30,000 + tax per application, including one test report, and ₹20,000 + tax per additional report. STQC lab testing fees are not published and are given by quotation.
How long does STQC testing take?
Industry estimates put STQC plus BIS at about 7–8 months per model. Lab capacity, application backlogs, code review findings and retests after firmware changes can all stretch this, which is why preparing before you apply matters.
Sources: STQC IoTSCS-P01, Procedure for CCTV Testing, Evaluation and Certification; STQC Guidance on Supply Chain Security Aspects – CCTV certification; BIS CCTV implementation guidelines; BIS circular on analog cameras. These rules change often, so check the latest MeitY, BIS and STQC notices before you apply.
Get your CCTV firmware ready before the lab sees it
Xtreme InfoSec runs a pre-assessment source code review and VAPT of your camera firmware, apps and cloud, maps the findings to the Essential Requirements and includes a free retest. We are not STQC or a lab; we help you arrive ready for one.