STQC Certification for CCTV, Biometric Devices and IT Products

STQC is the Standardisation Testing and Quality Certification Directorate under the Ministry of Electronics and Information Technology (MeitY). It runs electronics test labs such as the ETDC and ERTL centres and certification schemes for IT security (Common Criteria), Aadhaar biometric devices, websites, IoT systems and management systems like ISO 27001. Its work is technical; we handle the application side for you, so your engineers can focus on the product.

Yes, in effect. MeitY amended the Electronics and IT Goods (Requirement for Compulsory Registration) Order in April 2024 to add security Essential Requirements for CCTV, tested through STQC. After extensions to 9 April 2025 and a stock relaxation, MeitY withdrew the relaxation, so from 1 April 2026 no CCTV camera that fails the ERs may be sold. BIS safety registration is still needed alongside. We can check where your models stand today.

They test the camera’s cyber security rather than its picture. Reported areas include secure boot and firmware updates, strong access control and authentication, encrypted storage and network traffic, tamper resistance and penetration or vulnerability testing. The exact test list sits in the ER document for your product type. We get the current document to your engineers early, so the firmware is ready before samples go to the lab.

Yes. STQC’s ER testing covers security, while BIS registration under the Compulsory Registration Scheme covers safety and gives you the registration number on the label. A CCTV model needs both before it is sold. Many brands run both in parallel to save time. We can manage the BIS paperwork and the STQC file together, so dates and model numbers match.

STQC certifies them under its biometric devices testing and certification scheme, against UIDAI’s Aadhaar specifications. The scheme covers authentication devices at L0 and L1 levels (fingerprint and iris, discrete and integrated), enrolment devices, pre-certified hardware and QR code scanners for offline authentication. Devices are checked for image quality, durability, safety and EMC, function and security. We prepare the application and supplier documents with you.

An L0 device relies on the host system for encryption and stores keys in software. An L1 device is chip-based: encryption happens on the device inside a Trusted Execution Environment, with keys held in secure hardware. UIDAI introduced L1 fingerprint devices in 2022 and L1 iris devices in 2025. If you are designing a new device today, building for L1 from the start is the sensible route, and we can line up the certification file.

It is an evaluation of an IT security product, or a Protection Profile, against the international Common Criteria standard, run under the Indian Common Criteria Certification Scheme (IC3S). India is a Certificate Authorizing Nation under the Common Criteria Recognition Arrangement, so IC3S certificates are recognised by other member countries. Details sit on commoncriteria-india.gov.in. We help assemble the vendor documentation, while accredited evaluators do the technical evaluation.

No. Testing and evaluation are done by STQC, its labs or other designated and accredited labs; we have no lab and no test engineers. Our role is the regulatory side: choosing the right scheme, preparing company and product documents, filing the application, coordinating with the lab and tracking findings. Technical work stays with the lab, paperwork with us.

Fees depend on the scheme, the product and the tests involved, and STQC or the lab quotes them for your case. Lab and certification charges are paid to them directly. Our fee for the application work is separate and quoted before you commit. Send us the product list and the scheme you think applies, and we will come back with an exact estimate.