Talk to us

Blog

MeitY's Essential Requirements for CCTV, explained for buyers

Bipolar Factory · · 5 min read

Short answer: The Essential Requirements (ER) for CCTV are security requirements issued by India’s Ministry of Electronics and Information Technology (MeitY) for CCTV cameras and recorders sold in India, enforced through the Compulsory Registration Order (CRO). Hardware is tested by STQC-recognised labs and registered before it can be sold. The ER applies to devices, not to the software you run them with. Buyers should check the test report and registration for each camera model, and ask the VMS question separately.

This is a buyer’s summary, not legal advice. Check the current notification and have counsel confirm how it applies to your purchase.

What the ER is

MeitY publishes Essential Requirements for the security of CCTV equipment: a list of controls that a camera or recorder must meet, covering areas such as physical and hardware security, access control, secure software and firmware, network security, encryption of stored and transmitted data, logging, and the supply chain of components. Compliance is enforced by bringing CCTV into the Compulsory Registration Order under the Bureau of Indian Standards, so a model must be tested and registered before it is placed on the market.

The requirements are widely reported as applying from April 2025, with transition arrangements for stock already in the channel. Dates, scope and transition periods have moved more than once, so check the current notification rather than relying on a summary, including this one.

Who it applies to

  • Makers and importers of cameras and recorders. The obligation to test and register sits with them.
  • Any CCTV camera, NVR or DVR sold in India, whether domestic or imported. At the time of writing the makers with certified models on the STQC portal were mostly CP Plus, Sparsh, Matrix Comsec and Honeywell; global makers such as Axis, Hanwha Vision, Bosch, Vivotek and i-PRO were still working through the testing backlog. Certification is per model; check the STQC certified product list for the model you are buying.
  • Not video management software. The ER is written for devices. A VMS, whether installed on your own server or offered as a service, is not a product the CRO registers, and there is no STQC certification for software under this scheme. Any VMS vendor claiming to be “STQC certified” or “ER compliant” is describing something that does not exist. The same applies to Supervision.

How to check a model

Before a camera model goes on a purchase order, ask the supplier for two documents:

  1. The STQC test report for that exact model number and firmware version, issued by an STQC-recognised lab. Check the model number on the report matches the one on the quote, including suffixes; makers often sell several variants under one marketing name.
  2. The CRO registration showing the model is registered with BIS. Registration numbers can be checked on the BIS Compulsory Registration Scheme portal.

A brochure line saying “STQC approved” is not either of these. If the supplier cannot produce both, treat the model as untested.

Also note the firmware version on the test report. A later firmware is not automatically covered; ask the maker how they handle firmware updates under the scheme.

What changes for tenders and GeM

Public buyers and anyone buying through the Government e-Marketplace (GeM) should expect:

  • Tender specifications that require ER compliance for cameras and recorders, with the test report and registration as mandatory documents at bid stage.
  • Model-level evidence, not a maker’s blanket letter.
  • Separate treatment of software. A tender that asks for an “ER-compliant VMS” is asking for something no vendor can lawfully supply. The clean way to write it is: cameras and recorders must be ER-registered; the VMS must meet the buyer’s own security requirements (encryption in transit, audit logging, directory sign-in, offline operation, and so on), evidenced by documentation and a pilot.
  • Existing estates. Cameras bought before the order are generally not retrospectively affected, but replacements and expansions are. Check the transition rules in the current notification.

Why the VMS is a separate question

The ER secures the device: its firmware, its ports, its storage, its supply chain. It says nothing about the server that records twenty of those devices, who can log into it, whether footage leaves the building, or whether exports are logged. Those are the questions that decide whether an incident can be investigated and whether a data-protection request can be answered.

So evaluate the VMS on its own terms, using the ER’s control areas as a useful checklist: where is data stored, is it encrypted in transit and at rest, who can access it, is access logged, how are updates verified, and does it depend on anything outside the country or outside your network. See ten questions to ask a VMS vendor for the full list.

Where Supervision fits

Supervision is software, and holds no certification under the ER or any other scheme; no VMS does. It works with STQC-tested, CRO-registered cameras from CP Plus, Sparsh, Matrix Comsec and Honeywell, with Axis, Hanwha Vision, Bosch, Vivotek and i-PRO, and with any other camera that speaks ONVIF or RTSP. Certification is per model; check the STQC certified product list for the model you are buying. For buyers who want to see how a self-hosted VMS lines up against the ER’s control areas, Supervision maps its own security design to them on the security page: HTTPS on port 8443 with a pinned certificate, an audit log of camera changes, exports and user changes, roles from owner to viewer with directory sign-in, a single binary updated by file, and footage that never leaves your server. Treat that mapping as the vendor’s own description, to be verified in a pilot on your hardware.

Official references

Government pages move; if a link above no longer resolves, start from stqc.gov.in.

Supervision is self-hosted video management software for any camera brand. If this is the kind of problem you're solving, tell us about your cameras and we'll talk it through, or email hello@bipolarfactory.com.