STQC-Certified CCTV: What the 2026 Rule Means Before You Buy a Camera

If you've been pricing CCTV this year, you may have noticed two things: some very cheap cameras have quietly disappeared from listings, and installers keep mentioning something called STQC. There's a reason. Since 1 April 2026, India has required CCTV cameras and recorders sold here to meet a defined set of security standards. This post explains what that means in plain terms — and, just as importantly, what it doesn't mean.

What actually changed on 1 April 2026

The Ministry of Electronics and Information Technology (MeitY) notified a set of Essential Requirements for CCTV equipment — essentially a cybersecurity baseline. Cameras and recorders are tested against these requirements through the government's STQC testing process and registered with the Bureau of Indian Standards (BIS). An earlier relaxation that allowed some non-compliant stock to continue being sold was withdrawn, and from 1 April 2026 the sale of CCTV equipment that doesn't conform is no longer allowed.

The rule applies to every manufacturer and brand, Indian or foreign. It is about how the product is built and tested, not where the company is from.

Why the government did this

Modern CCTV is a network device. An IP camera or an internet-connected recorder is effectively a small computer sitting on your network, often reachable from the internet so that you can view footage on your phone. Poorly built cameras have long been a weak point: default passwords that never get changed, firmware that is never updated, and video streams sent without encryption. Compromised cameras have been used to spy on private spaces and even to launch attacks on other systems.

The Essential Requirements target exactly those weaknesses. In general terms, they cover things like:

• No fixed or shared default passwords that users can't change
• Protection of the device's firmware against tampering
• Encrypted communication for video and control data
• A proper way to receive and install security updates
• Testing of the device against known vulnerabilities

What it does not mean

There's been a lot of confusion, so it's worth being clear.

• Your existing cameras are not illegal. If your system was installed before the rule took effect and is working properly, you can keep using it. The requirement applies to the sale of new equipment.
• It is not a blanket ban on any brand. Brands whose models have been tested and registered can continue to be sold. What has changed is that each model has to clear the process.
• It doesn't automatically make an installation secure. A certified camera with its password left as "admin" and never-updated firmware is still a risk. Certification sets a baseline; good installation practice finishes the job.

Where buyers get caught out

Most problems come from buying outside the normal installer channel:

• Old or grey-market stock — unusually cheap cameras listed online may be leftover inventory that doesn't meet the requirements, or equipment brought in outside official channels.
• Mixed-up model numbers — a brand may have certified some models but not others. Certification applies to the specific model, not the whole brand.
• "Compatible" recorders — a certified camera plugged into an uncertified recorder that's exposed to the internet leaves the weak link in place.

How to check before you buy

You don't need to become an expert. Just ask the right questions:

• Ask your installer to confirm that the exact model numbers of both the cameras and the recorder are compliant with the Essential Requirements and BIS-registered.
• Check that the model number on the box and on the device matches the one on the quotation.
• Be wary of any quote that is dramatically cheaper than the rest without an explanation. As we explain in our CCTV price guide, a low number usually means something has been left out.
• Ask how firmware updates will be handled after installation, and who is responsible for them.

Should you replace your existing system?

Not just because of this rule. If your current system is working, recording reliably and has been set up securely, there's no requirement to replace it. It's worth reviewing it, though, especially if:

• Your cameras or recorder are still using the default password
• The firmware hasn't been updated in years, or the model no longer receives updates
• You view footage remotely through an app and aren't sure how that connection is secured
• The system is old enough that picture quality or storage no longer meets your needs

When the time comes to upgrade, new equipment will be compliant by default, and it's a good moment to consider moving from analog HD to IP. Our IP vs analog comparison covers that decision.

Five things to do with any CCTV system, certified or not

1. Change every default password on cameras, the recorder and the mobile app — and use a different one for each.
2. Keep firmware updated. Updates often close security holes, not just add features.
3. Limit internet exposure. Only enable the remote-access features you actually use, and turn off ones you don't.
4. Separate the network for larger sites, so cameras aren't on the same network as office computers and payment systems.
5. Review who has access. Remove app access for former staff, tenants or contractors.

An AMC is the easiest way to make sure these don't get forgotten — preventive visits cover firmware updates, storage health and access reviews alongside the physical checks.

Key takeaways

The 2026 rule is good news for buyers: it raises the baseline security of every new CCTV product sold in India. Your existing system can stay in place, but new equipment should be compliant model-for-model, and any system — old or new — is only as secure as its setup and maintenance. Explore our electronic security solutions, or book a free site survey and we'll recommend compliant equipment and set it up securely from day one.