Which Surveillance Cameras Must Undergo Testing According to QCVN 135:2024/BTTTT?

Internet Protocol surveillance cameras (IP Cameras) are increasingly used in Vietnam, leading to requirements for strengthened network information security management. To address this issue, the Ministry of Information and Communications (now the Ministry of Science and Technology) issued the National Technical Regulation QCVN 135:2024/BTTTT, aimed at establishing fundamental information security requirements for Internet Protocol surveillance cameras. The content below helps determine which cameras must undergo testing according to this regulation.

See more: Capacity Profile Of Phuc Gia Laboratory Corporation

Table of contents

1. Why is it necessary to issue a separate regulation for surveillance cameras?

The issuance of QCVN 135:2024/BTTTT stems from the reality that the surveillance camera market in Vietnam has grown rapidly but lacks a synchronized control mechanism for information security. For many years, a large number of cameras have been imported, installed, and put into use without undergoing mandatory security assessments, even though these devices directly connect to the Internet and process sensitive image data.

Statistics from authorities show that hundreds of thousands of cameras in Vietnam possess security vulnerabilities, even sharing data publicly on the Internet. These risks not only affect individual privacy but also pose potential threats to cybersecurity and social order, especially considering that cameras are infrastructure components of smart city systems.

QCVN 135:2024/BTTTT – the technical regulation specifying basic information security requirements for Internet Protocol surveillance cameras was issued by the Ministry of Information and Communications (now the Ministry of Science and Technology) on December 31, 2024, to address this management gap and bring IP cameras into a framework of minimum technical control for network information security.

2. Which Surveillance Cameras Must Undergo Testing According to QCVN 135:2024/BTTTT?

Based on Section 1.1 – Scope of Regulation of QCVN 135:2024/BTTTT, it specifies the basic network information security technical requirements for surveillance camera equipment using Internet Protocol.

Surveillance camera equipment using Internet Protocol refers to digital cameras capable of connecting via Internet Protocol to perform partial or full surveillance and recording.

As such, all camera devices with the capability to connect to the Internet to transmit, receive, store, or process surveillance data fall within the scope of this regulation, regardless of whether the intended use is residential or commercial. Specifically, IP cameras belonging to the HS codes listed below must undergo testing and conformity certification:

8525.83.10
8525.83.90
8525.89.10
8525.89.90

The determination based on HS codes provides a clear basis for regulatory authorities, importing enterprises, and manufacturers when performing testing, Certificate of Conformity procedures, and declaration of conformity for products before they are circulated on the market.

3. Evaluation Criteria for Surveillance Cameras

QCVN 135:2024/BTTTT specifies basic network information security technical requirements, focusing on mitigating common risks documented in practice. The evaluation contents include:

Password Management: Devices must have default passwords that are uniquely initialized and complex for each product. This requirement directly prevents brute-force attacks and stops thousands of cameras from being compromised via a single common default password.
Vulnerability Management: Manufacturers must establish a public channel (online system) to receive and publish information regarding security vulnerabilities. This directly addresses the issue of 360,000 cameras currently possessing vulnerabilities, creating a transparent and accountable mechanism for handling security weaknesses.
Software Update Management: Devices must feature a function that allows for secure over-the-air software updates with validity checks for the update files. This is an essential mechanism for manufacturers to patch discovered security holes, ensuring continuous protection for the device.
Communication Channel Security: Communication channels used for data transmission and device configuration must be encrypted. This helps combat eavesdropping and data theft, ensuring your images and information are not intercepted by malicious actors during transmission.
User Data Protection: Users’ personal data must be transmitted through encrypted connection channels. More importantly, devices must provide a function allowing users to delete their own personal data, directly addressing the risk of data leakage and unauthorized sale on social networks.
Other Requirements: The regulation also includes requirements for the ability to self-recover normal operations after an incident and the capability to validate input data to defend against other types of attacks.

4. Implementation Roadmap for QCVN 135:2024/BTTTT

Circular No. 21/2024/TT-BTTTT stipulates the implementation roadmap for QCVN 135:2024/BTTTT regarding IP Cameras as follows:

From February 15, 2025, QCVN 135:2024/BTTTT shall be applied on a voluntary basis for testing, Certificate of Conformity procedures, and declaration of conformity.
From January 1, 2026, surveillance camera equipment using Internet Protocol that is imported or domestically manufactured must comply (mandatory) with QCVN 135:2024/BTTTT before being circulated on the market.

QCVN 135:2024/BTTTT focuses directly on information security requirements for surveillance cameras using Internet Protocol. Under this regulation, every IP camera belonging to the HS codes mentioned above must undergo testing, certification, and declaration of conformity according to the issued roadmap.

RELATED POSTS

For more details, please contact us at:

PHUC GIA LABORATORY CORPORATION

PHUC GIA CERTIFICATION CENTER

PHUC GIA INSPECTION TESTING CENTER

Address: