ONVIF Profile V and Signed Video: The Two Standards to Write Into Your Next Camera Bid

A question tends to surface about three years after a camera system goes in, rarely from the person who signed the purchase order. Someone in accounting notices the monthly cloud video bill, or an insurer asks for a clip from an incident eight months earlier, and the system has to answer for itself. Can this video live somewhere else? Can we prove the clip is the clip? The honest answer has usually been no, for reasons that had little to do with the cameras on the wall.

Three pieces of standards work moved far enough this year that we have started writing them into the specifications we put in front of clients. Two answer those exact questions. The third is a quiet deprecation that will outlast many systems going in now.

How cloud video became a one way street

On premises, camera interoperability has been settled for well over a decade. ONVIF, the standards body that has shaped it since 2008, now counts upward of 33,000 conformant products, with separate profiles for live streaming, local recording, access control, and analytics metadata. A recorder from one manufacturer pulls a stream from another manufacturer's camera because both agreed on the same conversation.

Then recording moved to the cloud, and that agreement stopped at the firewall. Each manufacturer invented its own way of getting a camera out to a hosted service, proving the camera was the camera, and parking recordings in storage. Hardware and subscription became a single purchase, so leaving the service meant buying the cameras again. That is why the accounting conversation ends in a shrug.

What Profile V puts on paper

On July 9, 2026, ONVIF published a Release Candidate for Profile V, a specification for cloud based video surveillance, sometimes sold as video surveillance as a service. The camera reaches outward itself, holding open a WebSocket Secure connection ONVIF calls an Uplink, which is how a cloud client gets to a camera behind a firewall with nobody forwarding ports or standing up a VPN. Live video travels over WebRTC to a web based client, with two way audio on products whose hardware supports it. Event notifications come back as pull point messages riding that same Uplink, or as JSON over MQTTS. Recordings land in cloud storage, Amazon S3 and Azure Blob Storage among the named targets, encrypted before they leave the camera. Configuration can be handled from a conformant cloud client as well.

Profile V can be combined with ONVIF video and access control profiles, so a hybrid system keeping some recording local is still in scope, and ONVIF expects to finalize the specification at the end of 2026. Leo Levit, chairman of the ONVIF board of directors, framed the intent plainly, saying that as more security systems move to the cloud, the organization wants that shift to give customers more choice rather than less.

The security requirements live in add ons now

Profile V does not stand alone. Conformant products must also implement the Profile V Security Add on, itself a Release Candidate, which handles authorization through OAuth 2.0 with mutual TLS and access tokens, so nothing unapproved joins the exchange, and which requires recordings to be encrypted on their way into storage.

Putting those requirements in a companion document is a deliberate choice, and a sensible one. Profiles are fixed feature sets, which makes them good for interoperability and useless for keeping up with cryptography. Add ons are versioned, so they can be revised without a new profile cycle and without asking anyone to rebuild a working system. ONVIF applied the model again on September 9, 2026, with a Release Candidate for version 2.0 of its TLS Configuration Add on, which lets a conformant video management system configure or update TLS settings on a device and which ONVIF says strengthens how that traffic is protected.

Signing the footage where it is born

The insurer's question got its answer on August 26, 2026, when ONVIF released a Media Signing Add on as a Release Candidate. A conformant camera or video encoder cryptographically signs encoded video at the moment of creation. What the device embeds binds the footage to the hardware that captured it and guards the signed run of frames against alteration, so any tool built to the specification can tell a reviewer whether a clip is intact and where it came from, even after it has passed through several systems. The Release Candidate covers H.264 and H.265 video, with audio planned for a later version, and ONVIF has published the signing and verification framework as open source on GitHub.

Signed video also survives ordinary handling. Copy it, export it, hand it to an adjuster, and it remains checkable, so long as the signature and the data needed to test it ride along untouched. ONVIF presents the add on as reinforcement for chain of custody practice, not a substitute for it. In June 2025 ONVIF joined the Coalition for Content Provenance and Authenticity as a liaison member and set out to align its video authentication specification with Content Credentials, the provenance standard from a foundation whose founders include Adobe, Microsoft, Intel, and the BBC.

What a signature actually proves

It is worth being precise, because marketing around authenticity tends to overreach. NIST examined the technical approaches in its November 2024 report on reducing risks posed by synthetic content. A signature on metadata, the report explains, establishes that whoever signed vouched for the content and that nothing has shifted since. It does not establish that the metadata is truthful, and NIST is frank about where the scheme fails, naming compromised certificate authorities and leaked private keys. Watermarking holds up less well, because researchers have stripped or faked most methods in use. The report lands on the view that nothing available today works alone.

That is not a reason to skip signing but a reason to treat it as one strong link rather than the whole chain. Who had access to the device, and whether its clock was right, remain questions for your commissioning records.

The deprecation nobody mentioned to you

While the new specifications get attention, an older one is being retired. In October 2025 ONVIF announced it would end support for Profile S, the streaming profile that launched in 2011, on the grounds that the authentication written into it no longer matches what cybersecurity practice calls for. The June 2026 build of the conformance test tools, valid for nine months, is the final one a manufacturer can use to claim Profile S conformance. Profile T, which arrived in 2018, carries almost everything Profile S did plus further video surveillance capability, and most devices and clients already handle both.

Nothing breaks. ONVIF states plainly that retiring the profile leaves installed systems running as they do today. Writing Profile S into a project now, though, buys hardware tied to an authentication model on its way out, and ONVIF's own guidance is to move away from username token authentication in favor of TLS and HTTPS or Profile T wherever possible.

Writing this into a purchase

None of this requires waiting. Specify Profile T rather than Profile S on anything you buy now, and ask any vendor pitching a hosted video service to state in writing when it will support Profile V and the Media Signing Add on, and whether the cameras in the quote will get there by firmware update or by replacement. Because all three remain Release Candidates until the end of the year, a written commitment is worth more than a logo on a datasheet. Claims are checkable. ONVIF keeps a database of conformant products it calls the “authoritative source” for deciding whether a product really is conformant, searchable by profile, add on, and manufacturer. Cameras and recorders are network edge devices, so the guidance CISA collects for protecting them belongs in the same conversation, as does its Secure by Demand guide, published with international partners for the moment of choosing a product rather than recovering from one.

We read these specifications so our clients do not have to, and this batch is welcome, because both questions at the top of this article now have real answers. If you are planning a camera system, replacing one that has aged out, or wondering what your current one would survive, we are glad to look at it with you. Reach us through our contact page or call (781) 506-6008.

Sources

ONVIF: Profile V draft for cloud video
ONVIF: Profile V specification page
ONVIF: Media Signing Add on release
ONVIF: TLS Configuration Add on 2.0 release
ONVIF: A standard for proving video is real
ONVIF: Ending support for Profile S
ONVIF: Collaboration with the C2PA
ONVIF: Conformant product search
NIST: Reducing risks posed by synthetic content
CISA: Guidance for protecting network edge devices
CISA: Secure by Demand product selection guide
CISA: Announcement of the Secure by Demand guidance