The requirement matrix: what applies to what
Indian compliance is category-dependent. The working matrix for a typical enterprise or public purchase:
- WiFi access points — MTCTE + WPC (radio) + security status against the Wi-Fi CPE ITSAR + Trusted Source (for licensed operators).
- L2/L3 switches — MTCTE + security status against the applicable wired-equipment ITSAR + Trusted Source (operators). No WPC — no radio.
- Gateways / security appliances — MTCTE + wired-equipment security requirements + Trusted Source (operators); plus the logging behaviour public-WiFi rules expect, covered in our log-compliance guide.
- Cloud management platforms — not hardware-certified themselves; evaluate operator trust (vendor's Trusted Source status), data residency and audit trails instead.
- Public buyers add: local-content class (Class-I/II) under the Make-in-India order — the mechanics are in our GeM guide.
Copy-paste tender clauses
Adapt these two clauses and most of the compliance risk in a networking purchase disappears:
Clause 1 — certification. "All quoted equipment shall hold valid MTCTE certification, and WPC approval where the equipment contains a radio transmitter, in the name of the OEM, for the exact model numbers quoted. Certificate numbers shall be submitted with the technical bid and will be verified on the respective government portals. For equipment categories where security certification under the NCCS scheme is mandated, the bidder shall state the certification status against the applicable ITSAR, and certification (or a contractually bound commitment with penalties) shall be a condition of acceptance."
Clause 2 — provenance and support. "The bidder shall state whether the OEM is a designated Trusted Source under the Trusted Telecom framework and whether the quoted products appear on the Trusted Telecom Portal. The OEM shall confirm in writing: ownership of the device firmware, the security-patch commitment in years, the location of Indian RMA stock, and an escalation path to the OEM's own engineers."
The 30-minute verification
- Minutes 1–10: take the submitted MTCTE certificate numbers and verify them on TEC's portal — valid, in the OEM's name, exact models. Anything that fails here fails everything.
- Minutes 10–15: for radios, match WPC approvals to the same models.
- Minutes 15–20: check the vendor's Trusted Source claim and product listings as applicable.
- Minutes 20–25: run a MAC lookup on a demo unit — does the hardware resolve to the vendor's own IEEE registration or to an unrelated factory? The OEM vs ODM test in one step.
- Minutes 25–30: ask for the firmware changelog. A real OEM has one; a label has excuses.
Mapping the matrix to products
Applied to Immunity's portfolio, the matrix reads: NetWave WiFi 6 access points — MTCTE certified (and CE, FCC & RoHS compliant), WPC-approved radios; NetForce L2 and L3 switches — MTCTE certified; NetGuard Controller — MTCTE certified with DoT-aligned portal logging; all supplied by a Trusted Source with products on the Trusted Telecom Portal, manufactured at GIDC Sanand, under Immunity's own IEEE MAC block (OUI 50:48:2C:3), managed by NetCloud Central operated for Indian deployments. Security-certification status against current ITSARs is model- and date-specific — request the current file and we will map it to your checklist line by line.
Red flags that end evaluations early
- Certificates in a trading company's name with no OEM chain.
- "Similar model" certificates offered for the quoted SKU.
- Refusal to share certificate numbers "until PO".
- A "local" product whose MAC lookup resolves to an overseas ODM.
- Warranty promises with no Indian RMA stock location attached.
Frequently asked questions
We are a private company — which of this is mandatory for us?
MTCTE and WPC attach to the equipment being sold, so they apply regardless of buyer. Trusted Source procurement binds licensed operators; private buyers use it as a free screening bar.
Can we just buy on price and fix compliance later?
Certification is model-specific and cannot be retrofitted by the buyer. Equipment without the file stays without it — and the discount rarely survives the first failed audit.
How current is "current"?
Mandates phase in and ITSAR versions update. Verify status in your tender window, and for staged deliveries make continued validity a contract term.
Where do we start?
Put Clause 1 and Clause 2 in the bid, run the 30-minute verification on what comes back, and the field usually sorts itself.