India | August 2026

India’s regulatory framework for connected surveillance equipment has entered a more stringent phase, with cybersecurity becoming a central requirement for CCTV cameras and network surveillance systems. The Standardisation Testing and Quality Certification (STQC) Directorate, under the Ministry of Electronics and Information Technology (MeitY), is playing a key role in evaluating CCTV products against specified Essential Requirements (ERs) for security.

The regulatory shift is intended to strengthen the security of connected surveillance infrastructure and reduce risks associated with vulnerable firmware, insecure communications, unauthorised access and other cyber threats.

CCTV Compliance Rules Become More Stringent

The transition became particularly significant from 1 April 2026. In a January 2026 Office Memorandum, MeitY withdrew the earlier extension for existing CCTV stock and stated that the sale of CCTV cameras that do not conform to the notified Essential Requirements would not be permitted from 1 April 2026.

The Essential Requirements were originally notified by MeitY in 2024, with CCTV cameras subsequently brought under the Electronics and IT Goods (Requirements for Compulsory Registration) Order, 2021 for compliance with the applicable security requirements.

This development has significant implications for CCTV manufacturers, importers, system integrators, distributors and organisations procuring surveillance infrastructure.

What Is STQC IoTSCS?

The IoT System Certification Scheme (IoTSCS) is operated by STQC Directorate under MeitY. The scheme evaluates IoT products and systems across areas including sensing and embedded components, communication protocols, gateways, cloud interfaces, end-user devices and user interfaces.

CCTV cameras are among the product categories covered under the scheme. STQC states that certification provides users with greater confidence in the security functionality of IoT products and provides a metric for comparing security capabilities when selecting products.

For CCTV products, STQC conducts testing and certification against the applicable Essential Requirements notified by MeitY.

Cybersecurity Testing Goes Beyond the Camera Hardware

Modern CCTV cameras are connected devices rather than standalone recording equipment. They may communicate with networks, cloud platforms, mobile applications, storage systems and other security infrastructure.

Consequently, security assessment needs to consider more than image quality and recording capabilities.

STQC’s published CCTV testing procedure identifies areas including physical security, access control, network security and software security. It also addresses aspects such as exposed network services, communication protocols, physical interfaces, firmware extraction, firmware-update security, data storage and encryption.

The objective is to identify weaknesses that could potentially expose surveillance infrastructure to unauthorised access or manipulation.

Technical Construction File Becomes Important

An important component of the certification process is the Technical Construction File (TCF).

STQC’s CCTV certification procedure requires manufacturers or developers to document information necessary to demonstrate compliance with the applicable Essential Requirements. The TCF can include information concerning the IoT device, its intended use, development and manufacturing details, certifications, component information and other technical documentation.

STQC’s application documentation also asks manufacturers to provide information relating to the product’s development, outsourced components, System-on-Chip (SoC) details and country of origin, firmware information and supporting documentation.

This creates a stronger emphasis on product traceability and documentation throughout the development and manufacturing process.

Security Assessment Covers Multiple Layers

The IoTSCS framework does not treat cybersecurity as a single technical parameter. STQC describes assessment across physical, communication and application-interface aspects of IoT devices.

The certification scheme provides different assessment levels, with higher levels incorporating increasingly comprehensive security requirements. Level 1 represents a low-assurance level, while Level 2 adds requirements related to hardware and software security, and Level 3 introduces additional requirements for highly critical devices, including areas such as tampering and certain advanced attack scenarios.

For CCTV manufacturers, this means security needs to be considered throughout the product lifecycle rather than added as an afterthought.

Impact on CCTV Manufacturers

The stricter compliance environment is expected to increase the technical and documentation requirements associated with bringing CCTV products to the Indian market.

Manufacturers may need to strengthen:

Secure firmware development
Authentication and access controls
Communication security
Data protection
Firmware-update mechanisms
Hardware and physical security
Product documentation
Component and chipset traceability
Vulnerability management
Testing and certification processes

Manufacturers also need to account for changes to certified products. STQC certification documents indicate that significant product changes may require review and impact analysis to maintain certification continuity.

Certification Bottlenecks and Industry Challenges

One of the practical challenges associated with tighter certification requirements is testing capacity.

As manufacturers work to bring products into compliance, the availability and scheduling of appropriate testing facilities can influence certification timelines. This can create additional pressure for companies managing product launches, inventory planning and enterprise procurement commitments.

Smaller manufacturers may face a greater challenge because cybersecurity testing, documentation, engineering changes and certification processes can require specialised technical expertise and financial resources.

For companies operating on tight margins, compliance therefore becomes both a cybersecurity responsibility and a business-planning consideration.

What CCTV Buyers Should Check

The regulatory changes also have implications for buyers.

Businesses, government organisations, institutions and system integrators should pay greater attention to the compliance status of network cameras rather than selecting products purely on specifications such as resolution, storage capacity or artificial intelligence features.

STQC maintains a certified-product database for products evaluated under the IoTSCS. Its current published list includes certified network camera products from multiple manufacturers.

Buyers should therefore verify the relevant certification and product details before making procurement decisions, particularly for large-scale or security-sensitive deployments.

A Shift Toward Security-by-Design

The evolution of India’s CCTV compliance framework reflects a broader change in the connected-device industry.

As cameras become increasingly connected to corporate networks, cloud services and smart infrastructure, a compromised surveillance device can potentially become more than a security concern—it can become part of a wider cybersecurity risk.

The emphasis on secure firmware, controlled interfaces, protected communications, authentication, physical security, documentation and structured testing therefore represents a move toward security-by-design.

For manufacturers, compliance should increasingly be integrated into product development from the beginning. For buyers, cybersecurity compliance should become a core procurement criterion rather than a secondary consideration.

Looking Ahead

India’s approach to CCTV cybersecurity is continuing to evolve as connected surveillance becomes an increasingly important component of physical and digital security infrastructure.

The role of STQC, MeitY and the IoT System Certification Scheme provides a structured mechanism for assessing security requirements and improving confidence in connected devices. The regulatory framework also places greater responsibility on manufacturers and suppliers to demonstrate that their products meet the applicable security standards.

For the CCTV industry, the message is increasingly clear: security is no longer simply a feature of a surveillance product—it is becoming a fundamental requirement for market access and responsible deployment.

As India continues to expand its digital and connected infrastructure, stronger CCTV cybersecurity standards could play an important role in protecting the systems designed to protect people, businesses and public spaces.

https://www.instagram.com/chandan.dash.3192479?igsh=YjJzOWs4MXdreGN0&igsi=YjJzOWs4MXdreGN0

Dinesh Awadh