Cybersecurity certification for IP cameras: which label is the tender actually asking for?

Introduction

Almost every public-sector surveillance tender in Taiwan contains a line like "must comply with domestic cybersecurity requirements" or "must carry a cybersecurity label". It reads as one sentence, but you actually have to answer three questions: which label, which level, and is the certificate still valid.

While compiling our own surveillance catalogue we noticed something: the same camera's datasheet can list two labels, from two different issuing bodies, at two different levels. Of the 72 ACTi models in our catalogue, 24 carry this kind of marking — meaning two thirds are simply out of the running for such tenders, and the remaining third still needs careful reading.

This article is about that reading.

1. What actually appears on the datasheet

It is not a binary of certified or not. These are wordings we found on real manufacturer datasheets:

The last one is the awkward case. If a tender requires Level 2 or above and the datasheet names only the body, you cannot bid on that line alone — you have to go back to the manufacturer for a copy of the certificate.

2. TAICS and TCA are not the same thing

This is the point most often glossed over. Taiwan's IoT cybersecurity labelling does not come from a single source: TAICS and TCA, both of which appear on datasheets, are separate issuing bodies with their own assessment tiers. Hence the seemingly contradictory but entirely normal marking of "TAICS Level 1, TCA Level 2" on one device.

The practical consequences are direct:

• Tender says "TAICS label, Level 2" → a device with TCA Level 2 does not qualify
• Tender says only "must carry a cybersecurity label" → either works, but state clearly which one you are submitting
• Tender says "Level 2" without naming a body → that is an omission by the agency. Submit a written question before bidding; do not interpret it yourself

That last point is the most practical advice here. Keep the interpretation out of your own hands: being overruled at award is far more expensive than sending a clarification request.

3. CNS 16120 is a standard number, not a brand

The CNS in `CNS-16120 Level 1` is Taiwan's national standards numbering system. It is the standard itself; the bodies above are who certify against it.

So "complies with CNS 16120" and "holds a TAICS label" describe two different layers: the first is which standard the device was measured against, the second is who measured it and what level came out. They are usually written together, but a tender document may name only one of them — read which layer is being asked for.

4. The levels are about what was tested, not about quality

A higher level does not mean better image quality, and it does not straightforwardly mean "more secure". It reflects which set of checks was passed — generally, higher levels cover more ground (firmware update mechanisms, default password handling, transport encryption, access control).

We deliberately do not list the full test items per level here, because those change as the standard is revised, and a list frozen in an article only misleads people once it is out of date. For precision, read the standard version and assessment scope stated on the certificate itself. What this article can do is tell you that the certificate is the thing to read.

5. The side effect of hardened firmware on site

This section is not a tender requirement. It is something you meet during installation, and nobody puts it in a brochure.

Security-hardened firmware often switches off the convenient features along with the risky ones. We hit exactly this while writing a batch provisioning tool for hardened IP cameras: the industry-standard device discovery interface simply does not exist on that firmware, so the search tool you normally use will not find the cameras at all. The transport layer also needs compatibility with older implementations — you cannot assume the newest client will connect.

We ended up doing the same job through the web CGI instead: test the connection, create the administrator account, set the static IP, gateway and DNS, then capture the MAC and produce an inventory sheet. Per device this went from around five minutes by hand to about ten seconds.

Why this is worth mentioning: on a site with a hundred devices, configuring each one through its own web console is the slowest and most error-prone part of the whole job. If your labour estimate assumes five minutes per camera, hardened models will make that estimate wrong — because even finding the devices on the network becomes a separate problem.

6. A checklist before you buy

1. Which label and which level does the tender require? If it does not say, submit a question — do not interpret
2. Does the datasheet state a level? If it names only the body, ask the manufacturer for the certificate
3. Is the certificate still valid? Labels expire; a marking in a brochure does not expire on its own, but the certificate does
4. Is the model still in production? Certification is tied to the model, and a discontinued model's certificate will not save your delivery date
5. How are you estimating installation time? Hardened firmware can invalidate your whole batch-setup workflow

On the fourth point: while compiling our catalogue we verified that a manufacturer's official sitemap includes discontinued models — 73 of 139 candidates, more than half. Whether a model is discontinued can only be read from the product page title; the presence of a datasheet tells you nothing. Picking models for a bid straight from a manufacturer's website carries that risk.

Three questions we ask first

When someone comes to us about surveillance hardware, we usually ask these three before discussing models:

1. Is this a tender or for your own use? For a tender, the certification list comes before the specifications; for own use, the other way round
2. How many devices on the site? Past twenty or thirty, installation workflow costs more than the unit price difference
3. What is the existing recorder? The cameras have to talk to it — ONVIF compatibility matters more than megapixels

Powering them is a separate article: How to choose a PoE switch. Outdoor models with heaters draw heavily, and enough of them will hit the switch power budget.

In our surveillance catalogue, every model carrying Taiwan IoT cybersecurity certification is listed, while for the rest we keep only a representative model per form factor. The reason is this article: that certification is the hard gate on public-sector tenders, and it is the most useful part of any catalogue.