STQC and IS 13252 Explained: What India's CCTV Rule Means

By the Mama Editorial Team — we scope camera projects for Indian factories. Last checked 16 Oct 2026, against the MeitY gazette S.O. 1652(E), the BIS CRS CCTV implementation guidelines and the public BIS "ER Certified CCTV" list on crsbis.in, and the STQC IoT System Certification Scheme list.

In one line: India now requires every IP CCTV camera to pass two separate government tests before it can be sold — a safety test against the Indian standard IS 13252 (run under BIS), and a cybersecurity test against the Essential Requirements or "ER" (run by STQC-recognised labs). "STQC certification" and "IS 13252" are not two names for the same thing; they are the two halves of what "certified" means. Since 1 April 2026 a camera that fails either cannot legally be sold in India. Recorders (NVRs and DVRs) need the BIS safety registration; the ER security test is written for IP cameras. This page explains what each piece actually is, how they fit together, and — the part every other article skips — what the rule is not.

This is general information for plant owners and buyers, not legal advice. Certification scope and wording can shift; confirm the current text on the official BIS (crsbis.in) and STQC (stqc.gov.in) portals, and take formal legal advice before a large procurement or a regulated tender.

Most of the coverage online tells you the deadline and tells you to panic. Almost none of it stops to explain the actual objects in the sentence — what IS 13252 is, what the ER tests, what STQC is and why it is separate from BIS. That gap is why buyers mix them up, accept a half-certificate, and think a "BIS number" alone means a camera is legal. Here is the plain-language map.

Key points

• Two tests, not one. A legal CCTV camera in India carries a BIS safety registration (standard: IS 13252) and conformance to the Essential Requirements (ER) for cybersecurity (tested by STQC-recognised labs).
• IS 13252 is the safety standard — electrical and fire safety of the device. It says nothing about hacking.
• The ER is the security layer — locked debug ports, signed firmware with secure boot, encrypted transmission, a review for hard-coded credentials, component-source disclosure, penetration testing. (There is no standalone "no default password" clause.)
• STQC is the government testing body (under MeitY) whose recognised labs run the ER test. Its IoT System Certification Scheme (IoTSCS) network-camera list is now frozen (53 certificates, checked 16 Oct 2026); STQC issues ER test reports under the Compulsory Registration Order instead.
• Verify a camera per model, not per brand: find its BIS R-number and exact model in the Security-ER column of the public BIS "ER Certified CCTV" list on crsbis.in, or run the model through Mama's CCTV certificate checker.
• What it is NOT: not a "ban by country," not a quality or image test, and not an order to rip out cameras already on your wall.

What are the "Essential Requirements" (ER) for CCTV?

The Essential Requirements — usually written ER, and the CCTV set is often labelled ER-01 — are a list of security behaviours a network (IP) CCTV camera must demonstrate. MeitY (the Ministry of Electronics and Information Technology) notified them for CCTV in a gazette dated 9 April 2024 (S.O. 1652(E)), as an amendment to the Compulsory Registration Order that governs electronics sold in India.

Read the ER as a threat model, not a spec sheet. The requirements test for concrete failure modes a buyer can actually recognise:

• No default or hardcoded passwords — the camera can't ship on admin/admin across a whole production run; each device forces a unique credential at setup.
• Encrypted video streams — feeds travel over TLS/HTTPS, not as plain traffic anyone on the LAN can sniff.
• Secure boot with signed firmware — the device verifies its own firmware before running it, so a tampered image won't load.
• Disabled debug and test ports — no leftover telnet, serial or JTAG doors from the factory.
• Supply-chain / component disclosure — a declaration on the device's origin and critical components.
• Penetration testing — the model is actively attacked in a lab and known holes are closed.

Why an owner should care beyond paperwork: an uncertified IP camera is a documented network entry point. Hikvision's own CVE-2021-36260, an unauthenticated command-injection flaw, was mass-exploited across tens of thousands of exposed devices, and the Mirai botnet was built largely on hijacked cameras and recorders left on default passwords. The ER exists to shut that door before the camera is on your OT network, next to your PLCs and ERP.

What is IS 13252 (Part 1)?

IS 13252 (Part 1):2010 is the Indian safety standard for information-technology equipment — its full title is "Information Technology Equipment — Safety — General Requirements," and it is harmonised with the international basis IEC 60950-1. (IEC 60950-1 has since been superseded internationally by IEC 62368-1. India now accepts IS/IEC 62368-1:2023 in parallel, and under the BIS migration guidelines of 9 March 2026 IS 13252 is to be withdrawn from 1 November 2028.) It is the standard CCTV cameras and recorders are tested to under the Bureau of Indian Standards (BIS) Compulsory Registration Scheme.

What IS 13252 actually checks is ordinary product safety, not cybersecurity: protection against electric shock, adequate insulation and dielectric strength, and fire safety — fire-resistant materials and ventilation so the device doesn't overheat. When a camera clears it, BIS issues an R-number (a registration number of the form R-xxxxxxx). CCTV recorders have been under this CRS regime since 2018; the security layer is the newer addition.

The single most useful thing to hold onto: IS 13252 proves the box won't catch fire or shock someone. It says nothing about whether the box can be hacked. That is why the ER had to be added on top — and why a camera needs both.

What is STQC, and how is it different from BIS?

STQC — Standardisation Testing and Quality Certification — is a government body under MeitY that runs testing labs and certification schemes for electronics. For CCTV, STQC-recognised labs perform the ER (cybersecurity) test. Earlier passing models were published under STQC's IoT System Certification Scheme (IoTSCS), each with a certificate number of the form STQC/IoTSCS/ER…; STQC's IoTSCS scheme page now marks that network-camera list "no longer being updated", and it still holds the same 53 certificates (checked 16 Oct 2026). Under MeitY circular W-18/26/2025-IPHW of 4 February 2026, STQC now issues the ER security test report under the Compulsory Registration Order, and ER-compliant models show up on the BIS registration side. An STQC test report also satisfies the security requirement under India's Public Procurement (Preference to Make in India) Order, which is why it matters for government and PSU tenders.

The cleanest way to hold the three apart:

So "BIS" is who registers, "IS 13252" is the safety standard they register against, "ER" is the security requirements, and "STQC" is who tests the security. A vendor who waves a "BIS certificate" has, at most, shown you the safety half. For the full timeline of how these dates landed and what an owner has to do about them, see our companion piece, BIS/STQC 2026 for factory cameras: what owners must do.

How do you check a camera is actually certified?

Certification attaches to a model number, never to a brand — so a "brand is approved" claim proves nothing. The fastest route is Mama's CCTV certificate checker: paste the exact model and it matches it against the BIS and STQC primary lists. To check by hand, it takes about five minutes per model:

1. R-number and model on the BIS "ER Certified CCTV" list. On the public dashboard at crsbis.in, open the "ER Certified CCTV" tile (the "List of Registrations and models of CCTVs complying with ER for Security"). Find the R-xxxxxxx the vendor gave you and confirm that exact model appears in the "Models Complying with Security ER" column, under the correct maker, with status Registered and a Validity date in the future. A model listed only in the "Analog CCTV Camera Models" column is a safety registration, not an ER pass — and a sibling SKU from the same brand doesn't count.
2. Any STQC certificate the vendor shows. Older ER passes carry an STQC/IoTSCS/ER… number on the frozen STQC IoTSCS list; newer ones come as an STQC test report under the CRO. Match four fields: model number, certificate holder, validity date, and firmware/product line. An IoTSCS certificate past its validity date is history — the live basis is then the model's BIS ER entry. A brand-level claim with no model number is not a certificate.

A short buyer's checklist before you release a purchase order — get in writing: the BIS R-number for the exact model; the ER/STQC certificate for that SKU with the firmware build it certifies; the BIS R-number for the recorder (DVR/NVR) too — recorders need the safety registration, though the ER security test is written for IP cameras (details); and that the stock is current compliant stock, not pre-deadline inventory being cleared cheaply. We walk the "which models actually exist" question through in STQC/BIS-approved CCTV cameras in India: the 2026 list, explained, and if you're moving off an incumbent, the best Hikvision & Dahua alternatives for Indian factories compares the certified options.

The dates, in one table

For how this sits alongside the other CCTV and factory obligations landing this year, see the India factory CCTV compliance calendar for 2026.

What the rule is NOT

This is where the definitional value is, because the misunderstandings here cost money and cause needless panic.

• It is NOT a ban by country of origin. No brand is banned by name and no country is named in the rule. The law bans the sale of uncertified cameras. On the BIS "ER Certified CCTV" list, no models under the Hikvision or Dahua brand appear in the Security-ER column (checked 16 Oct 2026); the one Hikvision-named registration, Prama Hikvision India's R-71004456, lists 376 analogue camera models there. But a camera passes or fails on its certificate, not on its flag.
• It is NOT a quality or image test. IS 13252 and the ER test safety and security. Neither says a single word about resolution, lens coverage, low-light performance, or whether the camera survives heat, dust and vibration on a shop floor. A fully certified camera aimed at a blank wall is compliant and useless. Choosing the right model for the scene, and where to place it, stays entirely your job.
• It is NOT retroactive to cameras already on your wall. The rule targets sale, import and manufacture — not removal of installed, running cameras. Nothing on your existing wall became illegal overnight. But every replacement, expansion or new site must use certified gear, so a dead uncertified camera can't be swapped like-for-like. We cover that decision in do I have to replace my factory CCTV in 2026?.
• It is NOT a brand-level approval. Approval is granted model by model. The live public source is the BIS "ER Certified CCTV" list — 83 R-numbers carrying 925 distinct models in the Security-ER column, plus 1,092 analogue models listed separately (checked 16 Oct 2026); the STQC IoTSCS network-camera list is frozen at 53 certificates. To search them by brand or model, use Mama's certified CCTV finder.
• It is NOT proof of "sovereignty." A certificate proves one model passed a safety and security lab test on one firmware build. It does not tell you where the mobile-app or cloud traffic terminates, or whether an "Indian" brand rebadges foreign OEM hardware. Certified ≠ sovereign.

FAQ

Is STQC the same as IS 13252? No. IS 13252 is the Indian safety standard (electrical and fire safety), registered by BIS, which issues an R-number. STQC is the government body whose labs run the separate cybersecurity test against the Essential Requirements (ER). A legal camera needs both.

What does IS 13252 actually test? Product safety only — protection against electric shock, proper insulation, and fire safety (fire-resistant materials and adequate ventilation). It does not test cybersecurity; that is what the ER adds.

What is ER-01? It is the label often used for the set of Essential Requirements for CCTV security notified by MeitY in April 2024 (gazette S.O. 1652(E)): locked debug ports, secure boot with signed firmware, encrypted transmission, a review for hard-coded credentials, component/supply-chain disclosure, and penetration testing. Strong password policies appear only in the preamble, not as a numbered test clause.

How do I check a specific camera is certified? Per model. Find the BIS R-number and the exact model in the "Models Complying with Security ER" column of the BIS "ER Certified CCTV" list on crsbis.in (status Registered, validity in the future), or run the model through Mama's CCTV certificate checker. If the vendor shows an STQC certificate or test report, match model number, certificate holder, validity and firmware. A brand-level claim with no model number is not a certificate.

Does STQC certification mean the camera is good quality? No. It covers safety and cybersecurity, not image quality, lens coverage, low-light performance, weather resistance, or where to place the camera. Choose the model for the scene separately.

Do the rules force me to remove cameras already installed? No. The rule bans the sale, import and manufacture of non-conforming cameras — not the use of ones already running. Replacements and new sites must be certified. Confirm the current MeitY/BIS wording before assuming installed stock is grandfathered.

After the certificate: placing them right

Certification decides what you may legally buy; it can't tell you how many cameras or where. A certified camera pointed at a blind wall still sees nothing useful. Leave an email or phone in the form below and Mama comes back with a placement plan — how many cameras, ceiling or wall, which zones and hazards — plus a plain-language read of the space, with no site survey and no waiting.