Somewhere on the quote in front of you, probably in the small print under the camera model, there is a line that says ONVIF compliant. It is there to reassure you. It is meant to say: this equipment plays well with other equipment, you are not being locked in, your recorder and your cameras will talk to each other.
On its own, that line is close to meaningless.
ONVIF is not one thing you either comply with or do not. It is a set of separate profiles, each identified by a letter, and a device conforms to specific ones. A device that conforms to a profile your recorder does not use is, for your purposes, a device that does not interoperate. "ONVIF compliant" with no letter attached is a claim with no content in it — and the fix takes one sentence on a purchase order.
This article is about that one sentence, and about a piece of ONVIF's own history that tells you more about buying security equipment than any spec sheet will.
What a profile actually is
ONVIF's public materials list the profiles currently in play as A, C, D, G, M, S and T, plus Profile V (Release Candidate). ONVIF states that access control systems use Profiles A, C, D and M, and that video systems use D, G, M, S and T.
That is as far as we are going to take the letters, and the reason is worth stating plainly: the ONVIF specifications are restricted to members, and we have not read them. A security company paraphrasing a specification it has not read is how a buyer ends up with a written promise nobody can be held to. For requirement-level detail on a given letter, get it from ONVIF's own profile pages — and get your vendor to point at the same page.
What you can take away is the shape of the thing. There are separate profiles for video and for access control, some appear in both lists, and a device declares conformance to particular ones. Which means the useful question was never "is it ONVIF." It was always "which profiles, on which side of the connection."
What to do with that: on your next quote, look for a letter. If there is no letter, you have not been told anything yet.
The claim you should actually be checking
Here is the part that surprises most owners: an ONVIF conformance claim is a Declaration of Conformance. The manufacturer declares it. ONVIF publishes a list of those declarations, and the declaration is the artifact — not a certificate issued after an outside body took the camera apart.
That is not an accusation. Self-declaration is a normal and workable model, and a great deal of interoperability gets done that way. But it changes what you are relying on: a manufacturer's statement about its own product. So check that the statement exists and covers the exact model you are being sold, rather than trusting a marketing line printed by the same company.
Knowing that one fact is worth more than memorizing every profile letter. It tells you where to look and what kind of evidence you are looking at.
What to do with that: ask for the model number as it appears in ONVIF's conformant product list, not the model number on the brochure. Those are not always the same, and firmware versions can matter. If the model you are quoted cannot be found in the list, that is a question for the vendor to answer before you sign, not after.
Profile Q: the one that got withdrawn
If you only remember one thing from this article, make it this one — because it is the clearest example in the industry of a convenience feature turning into a liability, and it comes from ONVIF itself, about its own work.
Profile Q existed to make setup easy. ONVIF deprecated it on 1 April 2022. The stated reason, in ONVIF's own words:
"ONVIF deprecated Profile Q on April 1, 2022 because its specification requires a Profile Q conformant device to allow anonymous access to all ONVIF commands during the setup process in the factory default state. This does not follow current cybersecurity best practices…"
Read that slowly. The profile did not fail because of a bug someone found. It did what it was designed to do. A device in its factory-default state would accept ONVIF commands from anyone, with no credentials, so that installation would be quick and painless. In 2016 that looked like good engineering. Judged against how networks are actually attacked now, it looks like leaving the door open and calling it a welcome mat.
There is a second detail that matters commercially. ONVIF's position is that existing Declarations of Conformance with Profile Q remain valid indefinitely, though members may choose to withdraw them. So a Profile Q declaration on a product is not automatically revoked. A camera can still carry the claim. The claim can be perfectly accurate. And the underlying behaviour is the reason the profile was retired.
That is not a reason to panic about equipment you already own — it is a reason to understand what a conformance claim is and is not. A declaration tells you what a device was designed to do at a point in time. It does not tell you whether that design still reflects good practice. Nothing on a spec sheet updates itself.
What to do with that: if a quote in front of you today lists Profile Q, ask why, and ask what the device does in its factory-default state. And whatever the letters say, treat "change every default credential before the device goes on the network" as a line item on the installation, not a courtesy.
Profile V has not been released
You may hear about Profile V, and you should hear it correctly. ONVIF's page for it is titled Profile V (Release Candidate). It is aimed at cloud video streaming — outbound connections over secure WebSockets, OAuth 2.0 with mutual TLS, WebRTC streaming, MQTTS for events — which is a meaningful direction for anyone whose cameras report to a cloud service rather than a box in a closet.
It is also not something you can specify on a purchase order today the way you can specify a released profile. Release Candidate means the work is not final. If a salesperson lists Profile V (Release Candidate) alongside released profiles as the same kind of commitment, that tells you how carefully the rest of the quote was assembled.
What to do with that: if cloud video is where you are heading, ask what the plan is when Profile V (Release Candidate) is finalized, and whether the hardware you are buying now can be updated to it. Get the answer in writing. "Yes, by firmware" and "yes, by replacement" are very different answers.
Why any of this is worth your time
Interoperability is not a technical hobby. It is the thing that decides what happens in year six, when the recorder dies, or the software goes to a subscription model you do not like, or the company that installed everything stops returning calls.
If your cameras conform to profiles your next recorder also supports, you have choices. If they do not, your only path forward is to replace everything from the same vendor at that vendor's price, and the leverage in that conversation is entirely theirs. That is the commercial case for caring about a letter on a spec sheet, and it is the reason to settle the question at purchase, when you still have leverage.
Access control has a parallel worth knowing about: the Security Industry Association maintains OSDP, an open supervised device protocol for the reader-to-controller connection, now published as IEC 60839-11-5:2020. Same principle, different wire. There is no mandate requiring it, in Canada or anywhere else we can document, and anyone telling you otherwise is selling. But the question is identical — does this equipment speak something more than one manufacturer speaks?
The sentence to put on your quote
Ask for this in writing, before you sign:
- The specific ONVIF profile letters each camera conforms to, and the specific profiles the recorder or video management software supports. Both sides. A matching letter is the point.
- The model and firmware as listed in ONVIF's conformant product list, so the declaration can be looked up rather than taken on faith.
- Confirmation that any Profile V (Release Candidate) capability is described as a release candidate, with a written answer on what happens when it is finalized.
- A line item confirming default credentials are changed on every device at commissioning.
If a vendor can answer all four without hesitation, you are dealing with someone who has done this properly. If the answer to the first one is "it's ONVIF compliant," you now know exactly why that is not an answer.
