Selling devices in India: what you must now prove

In short

• CCTV cameras need an ER: 01 security test report before the Bureau of Indian Standards (BIS) registers them. Routers and Wi-Fi boxes need a security certificate from NCCS, the telecom security centre.
• CERT-In, India's cyber security agency, wants incidents reported within six hours. Buyers now ask for an SBOM, a list of the software inside your product.
• From 11 September 2026, makers selling in the EU must report exploited flaws on a 24 hour clock. Treat all of this as one firmware problem, not five projects.

One problem, not five projects

An Indian device maker now has to prove security in writing, model by model. Each rule needs the same raw material: an accurate list of what is inside your firmware, and proof for each rule. You also need to keep both up to date as the firmware changes.

It is tempting to run these as separate projects owned by different people. They are one problem, and the table below lists the decisions that sit with leaders.

CCTV cameras: ER: 01 through BIS registration

ER: 01 has been mandatory since 9 April 2025 for CCTV and IP cameras registered with BIS, except analog ones. The IT ministry, MeitY, notified the "Essential Requirement(s) for Security of CCTV" in 2024, under the Electronics and IT Goods (Requirements for Compulsory Registration) Order, 2021. BIS set the deadline.

Since then, BIS grants no new licence or model without an ER: 01 test report. Models in existing licences that do not comply are removed from the licence. Analog cameras were taken out after MeitY's clarification of 12 March 2025.

Three points from the BIS guidelines matter most for planning:

• One report per lead model. Third-party labs issue a test report for each lead model, the model tested for a series, naming the series models it covers.
• The firmware is pinned. Every product in a series must run identical firmware with a matching hash, a fingerprint of the file. Each software version you ship is tested as its own series. The certificate names the firmware version and hash, and any change must be documented in a differential analysis report that explains what changed.
• The fees are small; the work is not. For an existing licensee, BIS charges Rs 30,000 plus taxes per application, including one test report, and Rs 20,000 plus taxes for each extra report. The real cost is engineering time.

STQC, the testing body under MeitY, sets the test procedure. It adds three more points:

• a director with a DIN (Director Identification Number) signs the statement of compliance
• you supply samples or engineering boards with access probes
• the certificate lasts three years, subject to surveillance audit

Routers and Wi-Fi CPE: NCCS security certification

IP routers and Wi-Fi CPE need a security certificate under the ComSec scheme of MTCTE, India's mandatory testing of telecom equipment. A lab named by NCCS does the tests.

In a notice of 16 April 2024, NCCS made it mandatory from 1 July 2024 for models not yet certified by TEC, the Telecommunication Engineering Centre. For TEC-certified models in an operator's network, it applies from 1 October 2024 when they change hardware or software.

The rules are the Indian Telecom Security Assurance Requirements (ITSAR). Version 2.0.0 for both IP routers and Wi-Fi CPE came out on 1 December 2025. When we checked, the enforcement date on the document was blank, so ask your lab which version it tests against.

TEC 31318: the voluntary baseline

TEC 31318:2025 is a voluntary code of practice for consumer IoT, the internet-connected devices people use at home. It was revised in November 2025 to follow ETSI EN 303 645, the European baseline. Nobody fines you for ignoring it, but it is short and free, and the work carries over to buyers abroad.

CERT-In: six hours, and logs kept in India

CERT-In, India's cyber security agency, issued directions on 28 April 2022 that apply to every body corporate. That includes your company and the cloud behind your devices.

Listed incidents, including attacks on IoT devices and their servers, must be reported within six hours of noticing them. Logs of your IT systems must be kept for a rolling 180 days in India.

This is easy to miss. The device goes through a lab, while the cloud behind it sits in nobody's compliance plan.

SBOMs: from guideline to buying condition

An SBOM, or software bill of materials, lists the software parts in your product and their versions. CERT-In's SBOM guidelines, version 2.0 of 9 July 2025, are voluntary. But they recommend that some buyers require SBOMs when they buy: government and public sector bodies, essential services and software exporters.

They name SPDX and CycloneDX, the two common SBOM file formats. Suppliers should also state each vulnerability's status: not affected, affected, fixed or under investigation.

CCTV rules already need one in practice. The BIS series guidelines ask for an SBOM of firmware parts, open source libraries and third-party software.

Exporting to Europe: the Cyber Resilience Act

The EU's Cyber Resilience Act (CRA) covers connected products and their software sold in the EU, wherever they are made. From 11 September 2026, makers must report actively exploited vulnerabilities and severe incidents, even for products already on sale. Reports go to the Single Reporting Platform of ENISA, the EU's cyber security agency.

Everything else applies from 11 December 2027. Fines for breaking the essential requirements or Articles 13 and 14 reach EUR 15 million or 2.5% of worldwide turnover, whichever is higher.

Decisions for the leadership team

Most of this cannot be handed to a lab. These are the calls we would make this quarter.

What to ask a lab or a tool vendor

Ask a lab which ER: 01 or ITSAR version it tests against, how it treats a firmware update after the certificate, and what it accepts as a differential analysis report.

Ask a tool vendor which frameworks it maps to, which rules it decides on its own and which need your documents. A vendor that claims to cover it all is overselling. Much of ER: 01 is about debug ports, key handling in the factory and the supply chain, which no tool can see in a firmware file.

Where a firmware analysis helps, and where it stops

FDIE by Magdox maps evidence from each release it analyses to 14 frameworks. They include MeitY ER-01, NCCS ITSAR for IP routers and for Wi-Fi CPE, TEC 31318 and the CRA's essential requirements in Annex I.

We are plain about the split. Of ER-01's 30 provisions in the app, our device checks decide 4 on their own and give part of the evidence for 8 more. One comes from product data, and 17 need your documents or the lab's tests on the device.

For the two ITSAR documents together, the checks decide 5 of 312 test cases and help with 73. What the app does well is the part that repeats: an SBOM for every release, a comparison with the release before, and gaps listed as gaps. A lab or certification body still makes the final call.