STQC Certified CCTV: India's 2026 Rules Explained
A complete guide to India's mandatory 2026 CCTV cybersecurity rules, covering STQC certification, BIS registration under the CRO, transition deadlines, and an 8-question procurement checklist.
Exelon Circuits Team
Cybersecurity & Embedded Systems Specialist
Since 1 April 2026, CCTV cameras that do not meet the Government of India's cybersecurity Essential Requirements (ERs) can no longer be sold in India. A MeitY Office Memorandum dated 16 January 2026 withdrew the earlier relaxation that let sellers clear old, non-compliant stock.
If you are buying, installing or upgrading CCTV for an office, shop, factory, hospital or school, this guide explains what STQC certification means, how it relates to BIS registration and how to make sure the cameras you buy are compliant.
Why India Introduced Security Rules for CCTV
An internet-connected camera with weak security is an open door into your network. Compromised cameras can leak footage, expose other devices on the same network, or be hijacked into botnets for cyberattacks. Many low-cost cameras also shipped with default passwords and unpatched firmware.
To fix this, the Ministry of Electronics and Information Technology (MeitY) introduced cybersecurity Essential Requirements for CCTV and brought CCTV cameras under the Compulsory Registration Order (CRO) in April 2024.
- CCTV cameras sold in India must now meet mandatory government cybersecurity requirements.
- The security rules safeguard your network against device hijacking and video footage leaks.
What Is STQC?
STQC (Standardisation Testing and Quality Certification) is a directorate under MeitY. It tests and certifies CCTV cameras and recorders against the Essential Requirements under its IoT System Certification Scheme (IoTSCS).
Certification is done model by model. A brand having some certified cameras does not mean every camera it sells is certified.
STQC Certification vs BIS Registration
This is where many procurement teams get confused. Both relate to the same Essential Requirements, but they serve different purposes.
| Requirement | BIS Registration (under CRO) | STQC Certification (IoTSCS) |
|---|---|---|
| Run by | Bureau of Indian Standards | STQC Directorate, MeitY |
| Main purpose | Legal requirement to sell the camera in India | Proof of compliance for government and PSU procurement |
| Needed for private purchases | Yes | Not always, but increasingly expected |
| Needed for government tenders | Yes | Yes |
In simple terms, check for ER compliance and BIS registration for every new camera. If you supply government, PSU or sensitive sites, also require STQC certification.
Key Dates at a Glance
What Certified Cameras Are Tested For
Do I Have to Replace My Existing CCTV?
No. The rules apply to new sales. Existing CCTV systems can keep running.
However, older uncertified cameras still carry the same security risks the rules were designed to stop. If your existing cameras are connected to the internet or to your business network, a security audit is a sensible next step. This is especially true for banks, hospitals, schools and businesses that handle customer data.
Benefits of Choosing Compliant Cameras
Where Compliant CCTV Matters Most
CCTV Procurement Checklist — 8 Critical Vendor Questions
- Verify certificates for the exact camera model rather than accepting brand-wide claims.
- Check compliance for the full setup including network video recorders and cloud storage.
Certified Is Not the Same as Secure
A certified camera is a strong starting point, but security also depends on setup. Change all default credentials, keep cameras on a separate network segment, restrict remote access, update firmware regularly and review who has access to recordings.
Frequently Asked Questions
Secure Your CCTV Network
Exelon Circuits is an ISO 27001:2022 certified technology company offering cybersecurity audits and consulting for businesses in Mangaluru, Udupi and across India. We can check whether your cameras and recorders are compliant, find weak spots in your CCTV network and help you secure it.