China Launches 3-Star Cybersecurity Labels for IoT Cameras: What Buyers and Makers Must Know

Why Network Cameras Were Chosen First

Consumer network cameras are a typical "low-price, high-connectivity, high-privacy" product deployed in homes, shops, offices, warehouses, corridors, elder-care, and child-care scenarios. They continuously collect video, audio, environmental, and behavioral data. When security is inadequate, risks become concrete: privacy leaks, illegal surveillance, account theft, remote device control, and video data abuse.

Three characteristics make them a natural starting point:

Large quantity, scattered distribution: Many devices are managed by ordinary consumers, shop owners, or small organizations without professional IT staff.

Long lifecycle: Cameras often run for years, but firmware updates, vulnerability patches, account security, and cloud service changes rarely receive ongoing attention.

Physical-digital boundary: They are networked terminals that observe real-world spaces; a security failure bridges cyberspace into physical life.

The Label Is a Capability Tier, Not a Pass/Fail Certificate

The labeling scheme uses one-star, two-star, and three-star levels corresponding to Basic, Enhanced, and Leading capability tiers:

One-star (Basic security baseline): No weak or universal default passwords; basic vulnerability management and update capability.

Two-star (Mature product security): Higher requirements in identity authentication, communication security, data protection, and software security.

Three-star (High-risk scenario resilience): Beyond routine testing, must withstand stronger security tests verifying resistance to advanced attacks.

This gives consumers and procurers an externally verifiable security dimension. However, the label does not guarantee perpetual safety; security posture changes with firmware versions, component vulnerabilities, cloud services, and configuration. Reliable judgment requires checking the label level, validity period, filing information, test basis, and the vendor's ongoing maintenance capability.

Shifting from Feature Procurement to Risk Procurement

Traditional camera procurement prioritizes resolution, low price, and easy installation. A security-oriented model treats a camera as a data chain: device capture → app management → cloud storage/forwarding → account access control → network transport → possible integration with shop management, property platforms, campus systems, or home hubs. Any weak link turns the camera from a safety tool into a risk entry point.

The article proposes a "Five-Look Model" for procurement decisions:

Look at the label: Presence, star level, and scannable filing info — avoids relying on marketing claims.

Look at passwords: Forced default password change, strong password support, two-factor authentication, abnormal login alerts — weak passwords are a common entry point.

Look at updates: Firmware update availability, declared support period, vulnerability fix mechanism — long-term maintenance matters more than initial purchase.

Look at transmission: Encryption of video, credentials, and control commands; explicit remote access controls — prevents interception or tampering.

Look at permissions: Whether the app over-collects personal data, and clarity on purpose, retention, and opt-out — camera security includes personal information protection.

This model suits individual buyers and small-scale deployments (shops, property management, campuses, education, elder-care). The key is to stop treating cameras as mere hardware purchases and account for the accompanying account systems, cloud services, network links, and data processing activities.

For Vendors, Security Becomes a Product Competitiveness Factor

The labeling regime pushes vendors to front-load security into product design. The label cannot be earned by assertion; it requires a closed loop of testing, filing, capability grading, validity periods, key parameter change tracking, vulnerability handling, and information disclosure.

From a product engineering perspective, network cameras must build at least six capabilities:

Device identity management: Each device has a distinguishable, manageable, revocable identity — no reliance on shared default credentials.

Firmware and component governance: Track OS, third-party components, communication module versions to scope impact when vulnerabilities arise.

Secure default configuration: Factory settings minimize attack surface — unnecessary ports, services, and remote entry points disabled by default.

Data protection mechanisms: Classify video, audio, snapshots, account info, device logs; define collection, transmission, storage, and deletion rules per type.

Vulnerability response process: External intake channel; internal triage, fix, verification, disclosure, and release pipeline.

User-understandable prompts: Security is not thicker manuals; it's making users aware at critical moments what they are authorizing, enabling, or exposing.

Industry competition will shift from "spec-sheet rivalry" to "security trust rivalry." Future procurers will likely ask: Is there a label? What level? What test basis? How long is vulnerability support? Are key parameter changes re-filed?

For Organizational Users: Don't Leave Cameras on Default Configurations

Many risks stem from the interplay of product, configuration, and usage habits. Even labeled products need post-deployment governance. The article recommends a simple "Camera Asset and Risk Register" with these fields:

Device location: Installation site, whether sensitive areas are captured.

Device model: Brand, model, firmware version, label status.

Management account: Responsible person, strong password enabled, regular handover process.

Network access: Which network segment; isolation from office, POS, business systems.

Remote access: Whether enabled, which accounts can access, audit logging.

Data retention: Local vs. cloud storage, retention period, download permissions.

Update maintenance: Firmware update timestamps, vulnerability advisories, incident handling records.

This basic register solves a common problem: organizations often don't know how many cameras they have, who manages them, which are internet-exposed, which haven't been updated in years, or which accounts remain with departed staff or third parties. Without asset clarity, detection, hardening, and incident response cannot be effectively grounded.

Seven Immediate Actions for Ordinary Users

For already-installed cameras, a no-tool self-audit can be done now:

In the management app, confirm the default password has been changed to a complex one.

Check for firmware updates; prioritize upgrading to the official stable version.

Review unnecessary remote access, shared viewing, public links, or guest accounts — disable them.

Remove unused family, employee, or third-party maintenance accounts.

Turn off unneeded microphone, cloud storage, motion-detection push, or third-party integrations.

Adjust camera angles to avoid capturing bedrooms, changing areas, neighbors' entrances, or other sensitive zones.

When buying new devices, compare cybersecurity label, firmware update history, privacy policy, and after-sales support period.

These steps are simple but materially reduce common risks. Cybersecurity often starts with one fewer default password or one fewer long-unused shared account.

The Real Shift: Security Becomes Visible Product Language

The labeling system's significance goes beyond tagging a product category. It translates security capabilities — previously hidden in vendor R&D, test reports, vulnerability response, and compliance files — into a product language that ordinary users and procurers can see.

For consumers, "security" turns from a slogan into queryable information.

For organizational procurement, security requirements become easier to embed in tender conditions, acceptance criteria, and ops checklists.

For vendors, it forces product security from a post-hoc patch to a front-loaded design discipline.

For regulators and industry governance, it provides a finer-grained lever: not one-size-fits-all, but catalog-driven, tiered, scenario-based uplift of security capabilities.

This does not mean the label solves everything. Connected device security remains a continuous process influenced by product, configuration, user habits, cloud services, and vulnerability response. But it marks a new phase for IoT security: security is no longer only a post-incident expert concern; it will increasingly appear on product packaging, purchase pages, procurement lists, and daily usage interfaces. As high-frequency devices like cameras are required to articulate their cybersecurity capabilities, more connected products will face the same question: you must prove not just that you are usable, but that you are trustworthy.

Sources and References

Cyberspace Administration of China: "Notice on Issuing the 'Catalog of Products Implementing Cybersecurity Labels (First Batch)' and Related Implementation Rules," 2026-06-18. https://www.cac.gov.cn/2026-06/18/c_1783525604615337.htm Cyberspace Administration of China: "Notice on Issuing the 'Measures for the Administration of Cybersecurity Labels,'" 2026-04-10. https://www.cac.gov.cn/2026-04/10/c_1777558393316312.htm National Technical Committee on Cybersecurity Standardization: "Notice on Release of 'Network Security Standard Practice Guide — Cybersecurity Label: Consumer Network Camera Security Requirements,'" 2026-06-15.

https://www.tc260.org.cn/portal/article/2/a4a6de2b5ed2450f993c44966681faee

Cyberspace Administration of China: "Measures for Network Data Security Risk Assessment," issued 2026-06-18, effective 2026-08-20.

https://www.cac.gov.cn/2026-06/18/c_1783525609778371.htm