STQC and IS 13252 Explained: What India's CCTV Rule Means

By the Mama Editorial Team — we scope camera projects for Indian factories. Last verified: 9 September 2026, against the MeitY gazette S.O. 1652(E), the BIS CRS CCTV implementation guidelines on crsbis.in, and the live STQC IoT System Certification Scheme list.

In one line: India now requires every CCTV camera and recorder to pass two separate government tests before it can be sold — a safety test against the Indian standard IS 13252 (run under BIS), and a cybersecurity test against the Essential Requirements or "ER" (run by STQC-recognised labs). "STQC certification" and "IS 13252" are not two names for the same thing; they are the two halves of what "certified" means. Since 1 April 2026 a camera that fails either cannot legally be sold in India. This page explains what each piece actually is, how they fit together, and — the part every other article skips — what the rule is not.

This is general information for plant owners and buyers, not legal advice. Certification scope and wording can shift; confirm the current text on the official BIS (crsbis.in) and STQC (stqc.gov.in) portals, and take formal legal advice before a large procurement or a regulated tender.

Most of the coverage online tells you the deadline and tells you to panic. Almost none of it stops to explain the actual objects in the sentence — what IS 13252 is, what the ER tests, what STQC is and why it is separate from BIS. That gap is why buyers mix them up, accept a half-certificate, and think a "BIS number" alone means a camera is legal. Here is the plain-language map.

Key points

• Two tests, not one. A legal CCTV camera in India carries a BIS safety registration (standard: IS 13252) and conformance to the Essential Requirements (ER) for cybersecurity (tested by STQC-recognised labs).
• IS 13252 is the safety standard — electrical and fire safety of the device. It says nothing about hacking.
• The ER is the security layer — no default passwords, encrypted video, signed firmware, closed debug ports, supply-chain disclosure, penetration testing.
• STQC is the government testing body (under MeitY) whose recognised labs run the ER test and list certified models under its IoT System Certification Scheme (IoTSCS).
• Verify a camera in two places: its BIS R-number on crsbis.in, and its ER/STQC certificate on the STQC IoTSCS list — per model, not per brand.
• What it is NOT: not a "ban by country," not a quality or image test, and not an order to rip out cameras already on your wall.

What are the "Essential Requirements" (ER) for CCTV?

The Essential Requirements — usually written ER, and the CCTV set is often labelled ER-01 — are a list of security behaviours a network CCTV camera or recorder must demonstrate. MeitY (the Ministry of Electronics and Information Technology) notified them for CCTV in a gazette dated 9 April 2024 (S.O. 1652(E)), as an amendment to the Compulsory Registration Order that governs electronics sold in India.

Read the ER as a threat model, not a spec sheet. The requirements test for concrete failure modes a buyer can actually recognise:

• No default or hardcoded passwords — the camera can't ship on admin/admin across a whole production run; each device forces a unique credential at setup.
• Encrypted video streams — feeds travel over TLS/HTTPS, not as plain traffic anyone on the LAN can sniff.
• Secure boot with signed firmware — the device verifies its own firmware before running it, so a tampered image won't load.
• Disabled debug and test ports — no leftover telnet, serial or JTAG doors from the factory.
• Supply-chain / component disclosure — a declaration on the device's origin and critical components.
• Penetration testing — the model is actively attacked in a lab and known holes are closed.

Why an owner should care beyond paperwork: an uncertified IP camera is a documented network entry point. Hikvision's own CVE-2021-36260, an unauthenticated command-injection flaw, was mass-exploited across tens of thousands of exposed devices, and the Mirai botnet was built largely on hijacked cameras and recorders left on default passwords. The ER exists to shut that door before the camera is on your OT network, next to your PLCs and ERP.

What is IS 13252 (Part 1)?

IS 13252 (Part 1):2010 is the Indian safety standard for information-technology equipment — its full title is "Information Technology Equipment — Safety — General Requirements," and it is harmonised with the international basis IEC 60950-1. (IEC 60950-1 has since been superseded internationally by IEC 62368-1, but India still references the older basis here.) It is the standard CCTV cameras and recorders are tested to under the Bureau of Indian Standards (BIS) Compulsory Registration Scheme.

What IS 13252 actually checks is ordinary product safety, not cybersecurity: protection against electric shock, adequate insulation and dielectric strength, and fire safety — fire-resistant materials and ventilation so the device doesn't overheat. When a camera clears it, BIS issues an R-number (a registration number of the form R-xxxxxxx). CCTV recorders have been under this CRS regime since 2018; the security layer is the newer addition.

The single most useful thing to hold onto: IS 13252 proves the box won't catch fire or shock someone. It says nothing about whether the box can be hacked. That is why the ER had to be added on top — and why a camera needs both.

What is STQC, and how is it different from BIS?

STQC — Standardisation Testing and Quality Certification — is a government body under MeitY that runs testing labs and certification schemes for electronics. For CCTV, STQC-recognised labs perform the ER (cybersecurity) test and publish passing models under STQC's IoT System Certification Scheme (IoTSCS), each with a certificate number of the form STQC/IoTSCS/ER…. An STQC test report also satisfies the security requirement under India's Public Procurement (Preference to Make in India) Order, which is why it matters for government and PSU tenders.

The cleanest way to hold the three apart:

So "BIS" is who registers, "IS 13252" is the safety standard they register against, "ER" is the security requirements, and "STQC" is who tests the security. A vendor who waves a "BIS certificate" has, at most, shown you the safety half. For the full timeline of how these dates landed and what an owner has to do about them, see our companion piece, BIS/STQC 2026 for factory cameras: what owners must do.

How do you check a camera is actually certified?

Certification attaches to a model number, never to a brand — so a "brand is approved" claim proves nothing. Run two checks, in two places, per model. It takes about five minutes:

1. BIS R-number on crsbis.in. Open the registered-products search, choose the CCTV product category, and match the R-xxxxxxx the vendor gave you. Confirm it returns that exact model under the correct maker — not a sibling SKU from the same brand.
2. ER/STQC certificate on the STQC IoTSCS list. Confirm a valid security certificate for the same model, and match four fields: model number, certificate holder, validity date, and firmware/product line. A brand-level claim with no model number on the roster is not a certificate.

A short buyer's checklist before you release a purchase order — get in writing: the BIS R-number for the exact model; the ER/STQC certificate for that SKU with the firmware build it certifies; confirmation that recorders (DVR/NVR) are covered too, not just the cameras; and that the stock is current compliant stock, not pre-deadline inventory being cleared cheaply. We walk the "which models actually exist" question through in STQC/BIS-approved CCTV cameras in India: the 2026 list, explained, and if you're moving off an incumbent, the best Hikvision & Dahua alternatives for Indian factories compares the certified options.

The dates, in one table

For how this sits alongside the other CCTV and factory obligations landing this year, see the India factory CCTV compliance calendar for 2026.

What the rule is NOT

This is where the definitional value is, because the misunderstandings here cost money and cause needless panic.

• It is NOT a ban by country of origin. No brand is banned by name and no country is named in the rule. The law bans the sale of uncertified cameras. It happens to catch most Chinese-chipset Hikvision and Dahua lines because those struggled to clear the ER — but a camera passes or fails on its certificate, not on its flag.
• It is NOT a quality or image test. IS 13252 and the ER test safety and security. Neither says a single word about resolution, lens coverage, low-light performance, or whether the camera survives heat, dust and vibration on a shop floor. A fully certified camera aimed at a blank wall is compliant and useless. Choosing the right model for the scene, and where to place it, stays entirely your job.
• It is NOT retroactive to cameras already on your wall. The rule targets sale, import and manufacture — not removal of installed, running cameras. Nothing on your existing wall became illegal overnight. But every replacement, expansion or new site must use certified gear, so a dead uncertified camera can't be swapped like-for-like. We cover that decision in do I have to replace my factory CCTV in 2026?.
• It is NOT a single downloadable "approved list." Approval is granted model by model and lives on two churning government portals. Any tidy brand-count total you see online is a snapshot at best.
• It is NOT proof of "sovereignty." A certificate proves one model passed a safety and security lab test on one firmware build. It does not tell you where the mobile-app or cloud traffic terminates, or whether an "Indian" brand rebadges foreign OEM hardware. Certified ≠ sovereign.

FAQ

Is STQC the same as IS 13252? No. IS 13252 is the Indian safety standard (electrical and fire safety), registered by BIS, which issues an R-number. STQC is the government body whose labs run the separate cybersecurity test against the Essential Requirements (ER). A legal camera needs both.

What does IS 13252 actually test? Product safety only — protection against electric shock, proper insulation, and fire safety (fire-resistant materials and adequate ventilation). It does not test cybersecurity; that is what the ER adds.

What is ER-01? It is the label often used for the set of Essential Requirements for CCTV security notified by MeitY in April 2024 (gazette S.O. 1652(E)): no default passwords, encrypted video, secure boot with signed firmware, closed debug ports, component/supply-chain disclosure, and penetration testing.

How do I check a specific camera is certified? Two places, per model. Match the BIS R-number on crsbis.in, and confirm a valid ER/STQC certificate on the STQC IoT System Certification Scheme list — matching model number, certificate holder, validity and firmware. A brand-level claim with no model number is not a certificate.

Does STQC certification mean the camera is good quality? No. It covers safety and cybersecurity, not image quality, lens coverage, low-light performance, weather resistance, or where to place the camera. Choose the model for the scene separately.

Do the rules force me to remove cameras already installed? No. The rule bans the sale, import and manufacture of non-conforming cameras — not the use of ones already running. Replacements and new sites must be certified. Confirm the current MeitY/BIS wording before assuming installed stock is grandfathered.

After the certificate: placing them right

Certification decides what you may legally buy; it can't tell you how many cameras or where. A certified camera pointed at a blind wall still sees nothing useful. Record a two-minute phone walk of the floor and Mama returns a placement plan — how many cameras, ceiling or wall, which zones and hazards — plus a plain-language read of the space, with no site survey and no waiting.