| |
|
| Vietnam Issues QCVN 11 Cybersecurity Standard for Surveillance Devices, Effective July 2026 |
|
|
|
| Emily |
Published: ：2026/6/27 |
|
|
|
|
|
| |
|
| |
|
|
| Vietnam’s Ministry of Public Security has officially issued Circular No. 48/2026/TT-BCA, introducing a new national technical regulation, QCVN 11:2026/BCA, officially titled *National Technical Regulation on Internet Protocol Surveillance Camera Devices – Basic Cybersecurity Requirements*. The new regulation replaces QCVN 135:2024/BTTTT, which was previously issued by Vietnam’s Ministry of Information and Communications. The circular was signed by Minister of Public Security Lương Tam Quang and will take effect on July 1, 2026. |
| |
According to the Ministry of Public Security, QCVN 11:2026/BCA applies to IP surveillance camera devices manufactured and circulated in the Vietnamese market. It also applies to both domestic and foreign organizations and individuals engaged in the production, business operation, and importation of related products in Vietnam. In practical terms, brands, OEM manufacturers, importers, distributors, agents, and channel partners will all fall under this cybersecurity compliance framework once their products enter the Vietnamese market.
Vietnamese media reports indicate that Vietnam imports approximately 3.2 million surveillance cameras each year, while the number of cameras in operation across the country is expected to exceed 20 million by 2050. At the same time, data from more than 800,000 surveillance cameras has reportedly been leaked or circulated online, with nearly half of these devices exposed to the risk of being hacked or taken over. In some cases, leaked video footage has even been sold through online communities. Vietnamese authorities are concerned that such leaks may expose sensitive information, including daily routines, factory movement patterns, production processes, entry and exit records, and operational information related to organizations.
Moving Cybersecurity Requirements Upstream into Product Design
The technical requirements under QCVN 11:2026/BCA cover a wide range of cybersecurity issues. Each device must be equipped with a unique password or a user password mechanism capable of resisting automated attacks. Manufacturers are required to publish a vulnerability disclosure policy and response timeline. Software updates must include integrity and authenticity verification, while communication channels must be protected with industry-recognized encryption. Unused network and communication interfaces should be disabled, and devices must limit the amount of security-related information exposed before authentication during the initialization stage.
TÜV SÜD’s regulatory summary also notes that devices must be able to resume normal operation after network disconnection or power interruption. Users should be able to delete data stored on the device, and input data must be verified before processing. Manufacturers are also required to disclose the purpose of personal data collection, as well as how such data is processed and stored. In addition, devices and related services must support mechanisms for user consent and withdrawal of consent.
In the past, competition in the surveillance camera market often centered on resolution, night vision performance, AI recognition capabilities, compression efficiency, pricing, and delivery schedules. With the implementation of QCVN 11, however, firmware update mechanisms, password initialization processes, cloud service data handling, app permission design, API security, debug interface management, and the ability to delete device data will all become conditions for market entry. For vendors, cybersecurity documentation, vulnerability handling policies, test reports, and software maintenance cycles will need to be incorporated into product lifecycle management. For OEM manufacturers, cybersecurity clauses are expected to appear more frequently in customer specifications, while firmware and cloud collaboration will become key verification areas.
Based on the potential impact of Vietnam’s QCVN 11, the regulation should not be seen merely as a requirement to submit additional documents before importation. Instead, it places the cybersecurity design of the product itself within the scope of national technical regulation. If surveillance cameras continue to rely on shared default passwords, lack signature verification for update files, offer insufficient communication encryption, provide unclear cloud data flows, or fail to allow users to delete personal data stored on the device, they may face obstacles in import approval, market sales, and government procurement, even if their hardware specifications remain competitively priced.
ASEAN Is Taking Cybersecurity More Seriously
Cybersecurity requirements for smart devices are evolving rapidly across ASEAN. Vietnam’s QCVN 11, Singapore’s CSA framework, and recent updates to Indonesia’s related regulatory systems all show that the region’s oversight of smart hardware is becoming increasingly stringent. For the security industry, IP cameras, NVRs, VMS platforms, IoT gateways, access control controllers, and various edge AI devices are all likely to face stricter cybersecurity reviews in the future. Because surveillance cameras are continuously connected, deployed in large numbers, and directly exposed to video footage and site information, they are likely to become one of the first device categories prioritized by regulators.
|
| |
| |
※The text and images in this article may not be reproduced without authorization. For licensing inquiries, please email contact@aimag.tw — [iDS Magazine Statement]※ |
|
|
|
| |
|
| |
|
|
|
| |
|
