Do NVRs and DVRs Need STQC/BIS Certification in India? (2026)

By the Mama Editorial Team. We scope camera projects for Indian factories. Last verified: 29 September 2026, against the BIS CRS product list and the BIS CCTV implementation guidelines (22 Oct 2024) on crsbis.in, the BIS IS/IEC 62368-1:2023 migration guidelines (09 Mar 2026), the MeitY IPHW circular of 04 Feb 2026, and the STQC IoT System Certification Scheme pages on stqc.gov.in.

Yes for safety, and on current BIS wording no for the cybersecurity test. An NVR or DVR sold in India must be registered with BIS under the Compulsory Registration Scheme against the safety standard IS 13252 (Part 1):2010, which is moving to IS/IEC 62368-1:2023. The newer "Essential Requirements" (ER) security test, which STQC-recognised labs carry out, is written for cameras. BIS's March 2026 guideline states it as "Essential Requirement(s) for Security of CCTV for IP based CCTV Cameras". So a BIS R-number is the right thing to ask for on a recorder. An STQC security certificate for an NVR or DVR is a separate, optional certificate, and it usually matters only when a government tender asks for one.

This is general information for plant owners and buyers, not legal advice. Scope wording can change. Confirm the current text on crsbis.in and stqc.gov.in, and take formal advice before a large purchase or a regulated tender.

Key points

Recorders are in the BIS scheme. The BIS list of compulsorily registered products has one entry, S. No. 41: "CCTV Cameras/CCTV Recorders". It covers NVRs and DVRs and has done since 2018.
The safety test applies to both cameras and recorders. That is IS 13252 (Part 1):2010, and from now until 01 November 2028 a maker may test to either it or IS/IEC 62368-1:2023.
The ER cybersecurity layer is written for IP cameras. The 2024 gazette added the ER column "for CCTV Camera". BIS's rollout guideline speaks only of "CCTV Cameras", and its 2026 migration table says "for IP based CCTV Cameras".
STQC can still certify a recorder. Its IoT scheme says NVRs and DVRs get a vulnerability assessment, a software (VMS) security check and a bill-of-materials check, and then a certificate. This matters for procurement. We found no text making it a condition of selling a recorder.
Check the label. The BIS mark on the recorder carries an R-number, and you look that number up on crsbis.in for the exact model.
Your installed recorder is not affected. Nothing in these notifications tells a factory to remove equipment it already has running.

Device by device: what applies

Device	Safety (BIS registration)	Cybersecurity (ER)	Verify where
IP camera	Required: IS 13252 (Part 1):2010, or IS/IEC 62368-1:2023 during the parallel period	Required. No new BIS licence for CCTV cameras without ER after 09 Apr 2025	R-number and model on crsbis.in. Ask for the BIS letter listing the models that passed ER
NVR (network video recorder)	Required, same standards	Not required by the current BIS wording (ER is stated for IP cameras)	R-number and model on crsbis.in. STQC certificate only if your tender asks for it
DVR (digital recorder for analogue/HD-coax cameras)	Required, same standards	Not required by the current BIS wording	R-number and model on crsbis.in
Analogue / HD-over-coax camera	Required (it is a "CCTV camera" for safety)	Unclear. BIS 2026 wording says "IP based" cameras, so ask the vendor to show the BIS scope letter	crsbis.in. Get the vendor's position in writing
VMS software / cloud viewer	Not a product on the registration list	Not covered by the CRO ER entry. STQC's IoT scheme can test "Software application (VMS or any other) security" on request	Contract and vendor security documents

What the primary texts actually say

The confusion online starts with the BIS product list itself. Entry 41 reads "CCTV Cameras/CCTV Recorders — IS 13252 (Part 1) : 2010, Essential Requirement(s) for Security of CCTV". Read on its own, that looks like both requirements apply to both devices. The texts behind that line are narrower:

The gazette (S.O. 1652(E), 09 Apr 2024). It amends the Compulsory Registration Order: "For CCTV Camera, the following entry of Column (5) be added at S. No. 41", and column 5 is the Essential Requirements. The addition is worded for the camera. We read this through a published transcript. The official gazette copy, including its annexure, was not reachable when we checked.
BIS implementation guidelines (22 Oct 2024). Paragraph 1 confirms that "CCTV Cameras and CCTV Recorders as per IS 13252 (Part 1) : 2010 … is covered under mandatory certification". That is the safety half. Every ER instruction that follows is addressed to "CCTV Cameras". One example: "Beyond 09 April 2025 no Licence for CCTV cameras shall be granted without compliance to 'Essential Requirement(s) for Security of CCTV'". The suggested packaging line is "This CCTV camera complies with Essential Requirement(s) for Security".
BIS migration guidelines (09 Mar 2026). Row 24 of the table, "CCTV Cameras/CCTV Recorders", lists the current requirement as "IS 13252 (Part 1):2010, Essential Requirement(s) for Security of CCTV for IP based CCTV Cameras". The future requirement is "IS/IEC 62368-1:2023, Essential Requirement(s) for Security of IP based CCTV Cameras". This is the clearest statement we found. Safety covers the whole category. The ER covers IP cameras.
MeitY circular (04 Feb 2026). It says "CCTV Cameras were also notified … for compliance to the Essential Requirements (ERs) for Security … in addition to existing safety requirements (IS 13252: part 1: 2010)". Again the wording is cameras.

One contrary signal is worth knowing. MeitY's 2024 procurement notification (S.O. 1119(E)), as the Feb 2026 circular quotes it, refers to a security test report for "CCTV/VSS" (video surveillance system). A government or PSU tender can therefore reasonably ask for security testing of the whole system, recorder included. That is a tender condition, not a condition of sale.

The safety standard is changing: IS 13252 → IS/IEC 62368-1:2023

MeitY amended the Compulsory Registration Order by S.O. 4997(E) dated 29 October 2025. The amendment brings in IS/IEC 62368-1:2023 (audio/video and ICT equipment safety) and supersedes IS 13252 (Part 1):2010. BIS's 09 March 2026 guideline sets the timeline:

The old and new standards run in parallel until 01 November 2028, and CCTV cameras and recorders are on the list.
After that date "IS 13252 (Part 1):2010 and IS 616:2017 shall stand withdrawn" for these products, and existing licences without 62368-1 compliance stop being operative.
Where a camera's switch to 62368-1 affects its ER compliance, the maker must submit fresh ER test reports. Otherwise a signed declaration is enough.

For a buyer, either standard is valid on a recorder's registration until 01 Nov 2028. Ask the vendor which standard the model is registered to and whether a 62368-1 migration is planned. A model with no migration plan may face licence problems after that date, which matters for spares and warranty replacements.

How to check your recorder

It takes about five minutes per model:

Read the label. Look on the recorder's rating label or box for the BIS Standard Mark with an R-number (the form is R-xxxxxxxx), and note the exact model number.
Search crsbis.in. On crsbis.in, check that the R-number belongs to the manufacturer and that this exact model is in the licence scope. A sibling model on the same licence does not count.
Note the standard. See whether the model is registered to IS 13252 (Part 1) or IS/IEC 62368-1:2023.
Ask for STQC only if you need it. For a public-sector order or a customer audit that asks for it, request the recorder's STQC certificate. STQC says its network-camera PPO list "is no longer being updated and is retained solely for historical reference", so the BIS registry is the working check.
Check the cameras separately. For cameras, also get the BIS letter confirming ER compliance for the exact model and firmware.

If the recorder has no R-number at all, ask the supplier in writing why. Do not assume.

Already have a Hikvision or Dahua NVR?

The 2026 deadline you have read about was a selling deadline, and it concerned cameras that did not meet the ER. We found nothing in the gazette, the BIS guidelines or the MeitY circular that requires a factory to remove a recorder already installed, whatever the brand. A recorder was never inside the ER requirement as BIS currently words it.

What changes is buying. Any new or replacement recorder must carry a valid BIS registration for its model. Any new IP camera you connect to it must meet the ER. In practice the harder question is compatibility. Newer ER-compliant cameras enforce unique passwords and encrypted streams, and an older NVR may not add them cleanly. Test one camera before you order twenty. We walk through the keep-or-replace decision in do I have to replace my factory CCTV in 2026?.

An exemption from the law does not make a recorder safe. The recorder is usually the box that stores every stream and often faces the internet. Change its default passwords, update its firmware, and close remote ports you do not use. Our unsecured camera feeds audit checklist covers this step by step. For the general picture of what IS 13252, the ER and STQC each are, see STQC and IS 13252 explained. If you are weighing a recorder against cloud storage, see NVR vs cloud VMS.

FAQ

Does an NVR need BIS certification in India? Yes. NVRs and DVRs fall under the BIS Compulsory Registration Scheme entry "CCTV Cameras/CCTV Recorders" and must be registered against IS 13252 (Part 1):2010 or IS/IEC 62368-1:2023. Look for the R-number on the label and verify it on crsbis.in.

Does an NVR or DVR need STQC / ER cybersecurity certification? Not under the current BIS wording, which applies the Essential Requirements to "IP based CCTV Cameras". STQC does certify NVRs and DVRs on request, and government tenders may ask for it. Confirm the current text before a regulated purchase.

Is IS 13252 still valid for CCTV recorders? Yes, until 01 November 2028. Until then IS 13252 (Part 1):2010 and IS/IEC 62368-1:2023 run in parallel. After that date IS 13252 stands withdrawn for these products.

Is a "BIS certificate" enough when I buy cameras? Not for IP cameras. A camera needs both the safety registration and ER compliance for the exact model and firmware. A recorder only needs the safety registration.

Do I have to replace the DVR or NVR I already have? We found nothing in the notifications or BIS guidelines that requires removing installed equipment. The rules govern what is manufactured, imported and sold. Replacements must be BIS-registered models.

Where do I check whether a model is registered? On crsbis.in, by R-number and exact model. STQC's network-camera PPO list is kept only as a historical record.

Sources

BIS CRS, Products covered under Compulsory Registration Scheme, entry 41 "CCTV Cameras/CCTV Recorders": crsbis.in/BIS/products-bis.do
BIS Registration Department, Guidelines for implementation of "Essential Requirement(s) for Security of CCTV", 22 Oct 2024: CCTV_Implementation_guidelines.pdf
BIS Registration Department, Guidelines for Implementation of Migration to IS/IEC 62368-1:2023, 09 Mar 2026 (citing MeitY S.O. 4997(E), 29 Oct 2025): Guidelines_for_Implementation_of_Migration_to_62368_1_2023.pdf
MeitY IPHW Division, Circular No. W-18/26/2025-IPHW, 04 Feb 2026, via STQC: Circular for PPP certificate waiver
STQC, IoT System Certification Scheme (IoTSCS), notes on NVR/DVR: stqc.gov.in; certified list notice: stqc.gov.in
MeitY gazette S.O. 1652(E), 09 Apr 2024, and S.O. 4378(E), 09 Oct 2024 (extension to 09 Apr 2025). Official copies are on egazette.gov.in. We read the operative text through a published transcript.

The exact answer depends on your equipment

Which rules bite, and what is worth replacing, depends on the models in your rack and how your floor is laid out. Send us a video of your floor and a photo of your recorder's label. We will tell you what you have, what still needs checking and where the cameras should go.