With new regulations like STQC ER, CRO’24, and PPO’24, the government of India is setting stricter standards for video surveillance security. These rules ensure that only certified network cameras are used in government and private projects.
To break down what this means for businesses, security professionals, and government buyers, we spoke with Minu Chaudhary, senior product manager, video surveillance, at Matrix. In this discussion, we break down why these rules exist, how they affect existing network cameras, and what buyers need to do to stay compliant.
To start, what exactly is STQC ER compliance, and why is it important for network cameras?
Minu Chaudhary: Essential Requirements (ER) is a mandatory compliance framework designed to standardize cybersecurity, hardware safety, and supply chain transparency for network cameras in India. These requirements are established by MeitY (Ministry of Electronics and Information Technology), Government of India, which oversees technology policies and cybersecurity regulations in the country.
To ensure that cameras meet these standards, MeitY has appointed STQC (Standardization Testing and Quality Certification) as the official testing and certification body. STQC is responsible for evaluating network cameras under a structured framework known as the IoT System Certification Scheme (IoTSCS). This scheme is designed to test cameras for cybersecurity, image quality, durability, and compliance with national surveillance standards.
STQC ER Compliance also aligns with ISO/IEC 27402 standards, ensuring that certified cameras meet global IoT security benchmarks.
Does STQC ER Compliance only affect government procurement?
Minu Chaudhary: No, STQC ER compliance is not just for government projects. While all network cameras must meet Essential Requirements (ERs), the rules vary depending on where they are used.
For government projects, PPO’24 (Public Procurement Order 2024) is a policy that mandates only STQC ER-certified cameras can be used in government tenders. It ensures that surveillance systems in public buildings, defense, law enforcement, and smart city projects meet strict security standards. The policy also gives preference to locally manufactured cameras, supporting Make-in-India products. In fact, PPO’24 includes a minimum local content mandate that increases over time, promoting full localization of production. Suppliers are categorized as Class-I, Class-II, or Non-local based on the level of local content, with Class-I suppliers receiving priority in tenders. False claims regarding local content may result in blacklisting.
From June 6, 2024, STQC ER compliance became mandatory for all government-related CCTV procurements, as per the amended PPO. For government organizations, complying to PPO is now a non-negotiable requirement—without it, a project cannot be approved.
For further details, refer to PPO’24 Compliance Guidelines.
What about the private and corporate sectors? Do they need to comply with Essential Requirements?
Minu Chaudhary: Yes, but the rules apply differently. Essential Requirements (ERs) are mandatory for both government and private-sector cameras. For private businesses, there is another policy called CRO’24 (Customer Requirement Order 2024), which regulates the sale of network cameras and surveillance products in the private sector. It ensures that only ER-compliant cameras can be sold in India. Products must also comply with ISO/IEC 27402 standards for IoT cybersecurity. Risk assessment protocols, firmware security, and transparency in component sourcing are part of the compliance checks.
Many people confuse CRO’24 and PPO’24, but here’s the key difference: PPO’24 applies only to government agencies and projects, ensuring that they procure ER Compliant, STQC-certified cameras. CRO’24, on the other hand, applies to the private market, meaning all private businesses and corporate organizations, throughout India, looking to buy network cameras must now follow strict compliance rules as per ER.
By April 9, 2025, compliance with BIS safety and ER standards will be mandatory for all network cameras sold in India. In short, the certification is the same, but government-use cameras must pass more rigorous testing compared to private-sector cameras.
For compliance details, refer to CRO’24 Guidelines.
What parameters are tested for STQC ER Compliance?
Minu Chaudhary: STQC ER compliance evaluates cameras across five key areas.
The first area is Hardware-Level Security, where the physical integrity of the device is checked. Interfaces like UART or JTAG must be disabled or access-controlled, secure boot must be enabled, and sensitive data like keys or certificates must be stored securely. Features like tamper resistance, IP protection, and cryptographically secure random number generation are also evaluated here.
The second area is Software and Firmware Security. This ensures the firmware is protected against cyber threats. Memory protections like ASLR and DEP must be active, data in transit must be encrypted using strong TLS protocols, and firmware updates must be secure, signed, and protected from rollback. The use of banned code, hardcoded credentials, and lack of patching are also checked under this section.
The third is Secure Process Conformance, which looks at how the device communicates and how access is controlled. All communication must use encrypted channels and mutual authentication, and only standard, well-documented protocols are allowed.
Fourth is Supply Chain Security, which focuses on where and how components are sourced. Vendors must prove that they use trusted suppliers, have policies in place for risk management and incident handling, and take measures to avoid counterfeit components.
Finally, Security Conformance at the Product Development Stage is evaluated. This includes checking the design documentation, malware scanning before release, and evidence of strong QA processes that ensure the product is secure from the ground up.
Together, these five areas make STQC ER-certified cameras not only compliant, but also well-protected at every stage—from design to deployment.
For official compliance details, check STQC IoT System Certification Scheme.
Many businesses already have video surveillance systems in place. Will they need to replace them?
Minu Chaudhary: As compliance regulations evolve, businesses will eventually need to transition to STQC-certified, ER Compliant network cameras to avoid operational risks. For new installations, it is strongly recommended to choose STQC-certified, ER compliant solutions to ensure compliance with CRO’24 regulations, which mandate that only STQC-certified cameras can be sold in India.
Additionally, BIS (Bureau of Indian Standards) certification is now becoming a requirement for certain surveillance products, ensuring they meet safety and quality benchmarks. For government-linked businesses, STQC ER compliance is already mandatory under PPO’24, meaning that non-certified systems must be replaced to continue operations.
As enforcement tightens, even private buyers should consider upgrading to certified cameras to stay ahead of compliance requirements.
Our advice? If you are investing in security infrastructure, opt for STQC-certified network cameras now to stay ahead of compliance requirements.
Check out Matrix’s certified models like Ruggedized Network Camera and PTZ Camera.
What if businesses don’t comply? Are there penalties?
Minu Chaudhary: Yes, non-compliance leads to severe consequences for both government and private-sector buyers. Under PPO’24, non-compliant cameras will be outright rejected in tenders. Vendors making false claims about STQC-certified, ER-compliant network cameras, or local content risk being blacklisted, which can severely impact their eligibility for future government projects.
For private market sales governed by CRO’24, the implications are equally strict. Non-certified cameras will be banned from sale in India, and manufacturers or sellers who violate ER compliance guidelines may face legal penalties. To avoid these risks, businesses must ensure their surveillance products are fully certified and meet all required standards.
How can buyers verify if a network camera is STQC-certified?
Minu Chaudhary: To verify if a camera is genuinely STQC-certified, buyers should ask the manufacturer for the STQC certification number and official compliance documents. The product should also mention compliance under the IoT System Certification Scheme (IoTSCS), which is the framework used for evaluation.
For added assurance, buyers can cross-check listings on official platforms like the STQC website or the GeM (Government e-Marketplace), where certified products are published. This helps ensure the camera meets all regulatory standards and is safe for use.
Where can buyers find STQC-certified, ER-compliant network cameras?
Minu Chaudhary: STQC-certified, ER-compliant network cameras can be purchased through several authorized channels, ensuring buyers receive genuine, regulation-compliant products. For government buyers, certified cameras are available on GeM (Government e-Marketplace), where only verified, STQC-certified products can be procured for public projects. Additionally, the official STQC or MeitY listings provide a reference for approved surveillance solutions. For businesses and private buyers, certified cameras can be found through manufacturer websites, such as Matrix, which offers direct purchase options and certification proof. Buyers can also work with authorized distributors and system integrators, ensuring they receive genuine, STQC-certified products that meet PPO’24 and CRO’24 compliance.
Explore our certified models like Dome Network Camera and Bullet Network Camera to find the right solution for your needs.
To Sum Up
With regulations like STQC ER compliance, PPO’24, and CRO’24, surveillance is evolving to meet higher security and quality standards. But compliance shouldn’t be a challenge—it should be built into the solution.
At Matrix, we deliver innovative surveillance solutions that are already compliant, so businesses and government agencies can focus on what matters most. With our STQC-certified, ER-compliant cameras, you don’t have to worry about regulations—Matrix ensures security and compliance while you stay focused on your operations.
Want to include STQC-certified, ER-compliant network cameras in your security system?
Send an Inquiry or Request a Consultation today.
