CCTV Tender Specification Template for Indian Factories: STQC, BIS, ONVIF and Acceptance-Test Clauses
MeitY's 11 March 2024 advisory tells buyers to specify storage "in terms of storage duration (number of Days)", not TB. A sound factory RFQ also demands a BIS R-number and an ER/STQC certificate for each model, ONVIF Profile T, open RTSP, no default passwords and a signed acceptance test.
Verified against
- BIS Registration Department, Guidelines for implementation of "Essential Requirement(s) for Security of CCTV", 22 Oct 2024, including the attached MeitY Series Guidelines (crsbis.in PDF)
- STQC, IoTSCS P01 — Procedure for CCTV Testing, Evaluation and Certification, Issue 01, 21 May 2024 (stqc.gov.in PDF)
- MeitY gazette notifications S.O. 1119(E) (6 Mar 2024, procurement) and S.O. 1652(E) (9 Apr 2024, CRO); MeitY OM W-18/26/2025-IPHW, 16 Jan 2026 (crsbis.in PDF)
- BIS, Migration to IS/IEC 62368-1:2023 guidelines, 9 Mar 2026 (crsbis.in PDF)
- MeitY OM W-43/11/2021-IPHW, Advisory on the Threat of Information Leakage through CCTV/VSS/DVR/NVR, 11 Mar 2024, addressed to government ministries (copy hosted by AMU; we could not find it on meity.gov.in)
- ONVIF profile pages for S, T and G
- Axis white paper, Pixel density based on IEC 62676-4:2014 (whitepapers.axis.com)
- Checked 7 Oct 2026.
- Not verified: IEC 60529, IEC 62262 and IEEE 802.3 themselves (paywalled), so IP, IK and PoE figures are standard class values, not re-read; a meity.gov.in copy of the 11 Mar 2024 advisory; any CCTV-specific CERT-In advisory.
Clause table: copy-paste RFQ text
Paste the "Requirement text" column; fill the [brackets].
| # | Clause | Requirement text | Why | Primary source |
|---|---|---|---|---|
| 1 | BIS registration | "Every camera and NVR/DVR model offered shall hold a valid BIS registration (R-number) under IS 13252 (Part 1):2010 or IS/IEC 62368-1:2023, as required by the Electronics and Information Technology Goods (Requirements for Compulsory Registration) Order, 2021. The bidder shall list the R-number for each model. The Purchaser will verify each one on crsbis.in before issuing the PO." | BIS covers both cameras and recorders. IS/IEC 62368-1:2023 supersedes IS 13252 (Part 1); both run concurrently until 1 Nov 2028 | BIS guideline 22-10-2024, para 1; BIS migration guideline 09-03-2026, S. No. 24 |
| 2 | ER / STQC security | "Every network camera model shall comply with MeitY's 'Essential Requirement(s) for Security of CCTV', as notified and amended. For each model the bidder shall submit (a) proof that BIS has accepted ER compliance for that model, and (b) the ER test report or STQC certificate showing the firmware version and hash value tested. Delivered units shall run a firmware version that this evidence covers." | Per MeitY's series guidelines, each firmware version is a separate series, and the certificate states version and hash. The ER covers IP cameras, not recorders | MeitY Series Guidelines items 4 and 7; STQC P01 §7 (valid 3 years, subject to surveillance audit); S.O. 1119(E) para 5 |
| 3 | Analogue declaration | "The bidder shall mark each line item as network (IP) or analogue." | MeitY's notification of 12.03.2025 clarified that the security ER Order does not apply to analogue cameras | BIS circular, 1 Apr 2025 |
| 4 | ONVIF | "Every camera shall be listed as ONVIF Profile T conformant on onvif.org/conformant-products on the bid date. Profile G is required where edge (SD-card) recording is specified." | Profile T covers H.264/H.265, HTTPS streaming, motion and tampering events, and metadata. Profile S is being deprecated, and conformance submissions close on 31 Mar 2027 | ONVIF Profile T, Profile S, Profile G |
| 5 | Open RTSP | "Each camera shall serve its main and sub stream over RTSP to any third-party client on the LAN. A non-admin user account shall be enough to pull the stream, with no extra licence or vendor cloud. The bidder shall document the stream URL format." | Lets you add analytics or a new VMS later. The ER test list makes vendors disclose any proprietary network protocol, with source code, to the lab | RFC 2326 (RTSP); STQC P01 ER 3.5 |
| 6 | Codec | "Each camera shall support H.265 and H.264 on all streams. Storage sizing shall assume H.265 at the bitrate stated in the bid." | Fixes the bitrate assumption the storage quote is built on | ITU-T H.265 |
| 7 | Pixel density | "At each position listed in Annex [A], the bidder shall show by calculation at least [125] px/m (Recognition) at [X] m, using the IEC 62676-4 pixel-density method." | Replaces a vague "4 MP" with a measurable outcome. Levels (IEC 62676-4:2014): 25, 63, 125, 250 px/m; the 2025 edition uses a new 20–1,500 px/m scale, so name the edition | Axis on IEC 62676-4:2014 |
| 8 | Ingress / impact | "Cameras in [dusty, wash-down or forklift zones] shall be rated IP67 (IEC 60529) and IK10 (IEC 62262), as stated on the OEM datasheet." | Standard class values: IP6x = dust-tight, IPx7 = temporary immersion, IK10 = 20 J impact | IEC 62262 (webstore); IEC 60529 (not re-read, see above) |
| 9 | PoE budget | "Each camera's maximum draw (IR and heater on) shall not exceed the device power of its IEEE 802.3 type. Each switch's PoE budget shall be at least [1.2] × the total maximum draw of its cameras. No copper run shall exceed 100 m." | Standard class values: 802.3af (Type 1) about 12.95 W at the device, 802.3at (Type 2) about 25.5 W; 100 m copper channel. Night IR pushes cameras toward these limits. The 1.2× headroom is our assumption | IEEE 802.3-2022 |
| 10 | Retention | "Every camera shall record continuously for [N] days at the resolution, fps and bitrate stated in the bid. Capacity shall be quoted in days, not TB." | MeitY advises sizing storage by duration based on operational need | MeitY OM 11-03-2024, Annex A (xv) |
| 11 | Credentials | "No device shall be handed over with a default or blank password. Each device shall have a unique strong password. Admin credentials pass to the Purchaser at handover. Integrator access shall use named, role-based accounts." | The ER test list also checks firmware for hard-coded credentials (backdoors) | MeitY OM (vii), (xiv); STQC ER 2.6 |
| 12 | Firmware | "The OEM shall publish signed firmware and a vulnerability-notification process, and supply security updates for [5] years from handover. All devices shall run the latest certified firmware at handover." | The ER test list covers code signing, anti-rollback, update SOPs and an SBOM with known vulnerabilities | STQC ER 2.5, 2.10–2.12; MeitY OM (viii) |
| 13 | Exposure | "UPnP, P2P cloud and unused services shall be disabled. No port shall be forwarded to the internet. Remote access, if any, shall be via VPN. Cameras shall sit on a separate VLAN." | MeitY advises segmentation, VPN and disabling unused features | MeitY OM (v), (x), (xi) |
| 14 | Encryption and logs | "Web and ONVIF management shall use HTTPS/TLS. The NVR shall keep exportable user-access logs for [90] days." | Covers encrypted transit and auditing | STQC ER 2.2; MeitY OM (ix), (xii) |
Acceptance test at handover
Release the final payment only when every line below is signed off.
- R-numbers: for each model, the label on the box matches the crsbis.in record (how to check).
- Firmware: the version shown in each camera's web UI matches the version on the ER/STQC certificate.
- ONVIF: a third-party ONVIF client discovers every camera and pulls its profile list.
- RTSP: VLC opens the main and sub stream of three sample cameras using a non-admin account.
- Codec and bitrate: each stream shows H.265 at the bid bitrate.
- Pixel density: a test chart at the distance listed for that position in the tender's Annex [A] reaches the agreed level on live view.
- Retention: after 72 hours of recording, the NVR's projected retention meets [N] days. Confirm the full figure at the 30-day check.
- Credentials: factory-default logins fail on every device; admin passwords are handed over sealed.
- Exposure: UPnP and P2P are off, and a scan from outside the plant shows no open camera or NVR ports.
- Power cut: pull mains. The PoE switch and NVR ride through on UPS; every camera records again within [5] minutes of power returning.
- Night and logs: one shift with IR on, no camera drops off PoE, and the exported NVR access log shows the test logins.
Where sources differ
- The "three ER dates" are two gazette instruments. STQC's 6 March and MeitY's "7 March, No. 1062" are one notice, S.O. 1119(E) (dated 6, published 7 March), setting ERs for government purchases. The 9 April date used by BIS and the 16 Jan 2026 OM is S.O. 1652(E), which put the ER into the CRO and so governs every sale. In a tender, write "as notified by MeitY, as amended" rather than one date.
- ER compliance and ONVIF conformance are separate checks. Neither proves the other. Ask for both.
- The MeitY advisory is addressed to government buyers. For a private plant its measures are good practice, not law. The 1 April 2026 sale ban binds every seller, so it protects private buyers too.
- DORI Observation is quoted as 62 or 63 px/m by vendors; Axis's IEC 62676-4:2014 paper says 63.
- These documents set no retention period (retention guide).
What breaks in a factory
- Heat: compare the datasheet operating range with your hottest bay under a tin roof.
- Dust and lint: an IP rating protects the inside of the camera, not the front glass. Put dome-wiping in the AMC.
- 50 Hz LED flicker: require a 50 Hz anti-flicker setting and test it under your high-bay lights.
- Power cuts: a UPS on the NVR alone is not enough. Without one on the PoE switch, every camera goes dark (PoE budget guide).
- Long runs: a camera at 120 m needs fibre or an extender.
- CGNAT: if your ISP puts the plant behind carrier-grade NAT (ask them), vendors fall back on P2P cloud, which Clause 13 bans. Plan a VPN instead.
When to call the installer / what to ask the vendor
Ask bidders for a compliance sheet: each clause marked Comply, Deviate or N/A, with evidence. For the meeting, use our vendor question script. Recorders have their own rules, covered in our NVR/DVR certification explainer. Stream URL formats by brand are in the RTSP/ONVIF cheat sheet.
Where Mama fits
Clauses 4 and 5 keep your cameras open to analytics later. Mama reads existing cameras over RTSP/ONVIF and tells the owner where machines sat idle yesterday. Leave an email or phone in the form below.
FAQ
What should a CCTV tender specification include? Per-model BIS R-numbers and ER evidence, px/m at a stated distance, ONVIF profile and RTSP access, codec, retention in days, PoE and UPS sizing, cybersecurity duties, and an acceptance test tied to payment.
Is STQC certification mandatory for CCTV cameras in India? For network cameras, ER compliance is: since 1 April 2026, CCTV cameras not conforming to the ERs notified on 9 April 2024 may not be sold, per MeitY's OM of 16 Jan 2026. The proof is BIS's acceptance per model, on a test report from a recognised lab. An STQC certificate is what government buyers name. The security ER does not apply to analogue cameras.
Should I specify ONVIF Profile S or Profile T? Profile T. ONVIF lists Profile S as being deprecated, with the last conformance submissions on 31 March 2027. Add Profile G if cameras must record to SD card.
Do NVRs and DVRs need BIS registration? Yes. BIS lists "CCTV Cameras and CCTV Recorders" under IS 13252 (Part 1), now moving to IS/IEC 62368-1, so check the recorder's own R-number. On current BIS wording, the security ER applies to IP cameras, not recorders.