NDAA Section 889 and FCC rules: what US security integrators should know

CamVerion team · 7 November 2026 · 8 min read

"Is it NDAA compliant?" is now a routine question on US security projects, and for good reason. But it is often asked and answered loosely. Two separate sets of rules tend to get mixed together: procurement restrictions under Section 889 of the National Defense Authorization Act, and equipment authorization rules from the Federal Communications Commission (FCC).

This guide separates them and suggests how an integrator can reduce risk. It is general information, not legal advice. Government contract and FCC rules are detailed and still changing, so talk to counsel before relying on any of this for a specific contract.

The short version

Section 889 restricts what the federal government buys and what federal contractors and grant recipients may use or pay for in certain ways. It does not generally ban private companies from using this equipment for their own private purposes.
FCC rules control which equipment can be authorized, imported and marketed in the US. They work separately from Section 889.
The named companies relevant to video surveillance are Hikvision, Dahua and Hytera, along with their subsidiaries and affiliates. Huawei and ZTE are named for telecommunications equipment.
The practical step is to know your customer's status, check your bill of materials, and get supplier documentation for every device.

Section 889 explained

Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 targets "covered telecommunications equipment or services." It names:

telecommunications equipment produced by Huawei and ZTE, including their subsidiaries and affiliates
for certain purposes, video surveillance and telecommunications equipment produced by Hytera, Hikvision and Dahua, including their subsidiaries and affiliates. Those purposes are public safety, security of government facilities, physical security surveillance of critical infrastructure and other national security purposes
other entities that the government may designate

The main parts

The law has several important parts that apply in different ways:

Section 889(a)(1)(A), often called Part A, stops federal agencies from buying or obtaining equipment or systems that use covered equipment as a substantial or essential component.
Section 889(a)(1)(B), often called Part B, stops agencies from contracting with an entity that uses such equipment or systems. This is the wide-reaching part, because it reaches what a contractor uses internally, not only what it delivers.
Section 889(b) applies restrictions to spending federal loan and grant funds on such equipment or services.

The law also includes exceptions, including for equipment that cannot route or redirect user data traffic or see the data it carries. Do not rely on an exception without qualified advice.

The rules for federal contractors are implemented through the Federal Acquisition Regulation, including clause 52.204-25 and related provisions. Contractors usually have to make representations, so a wrong answer has consequences beyond a single project.

Who it affects in practice

Consider these typical customers.

Customer	Likely concern	What to do
Federal agency or base	Section 889 applies directly	Expect written requirements and flow-downs
Federal contractor	May have made representations about its own systems	Ask its contracts team what it requires, even on a commercial-looking site
State or local body, school or hospital using federal funds	Grant conditions may apply	Ask whether federal money is paying for the project
Critical infrastructure operator	FCC rules, internal policy, insurers	Ask for requirements in writing
Ordinary private business	Generally not directly covered by Section 889	Still consider its future plans, and any state rules

Your own company may be affected too. If you hold or want a federal contract, your internal systems are relevant, including the cameras in your own office. Also, if you are a subcontractor, requirements may be passed to you through your contract.

FCC rules: a separate track

The FCC maintains the Covered List of equipment and services deemed to pose an unacceptable risk to national security. Its rules affect whether new equipment can receive FCC authorization, which is generally needed before it can be imported or marketed in the US.

The rules have developed in stages, and a few are worth knowing.

2022: First Report and Order

The FCC prohibited authorizing covered equipment, which for Hikvision, Dahua and Hytera applies to the extent that equipment is used for public safety, security of government facilities, physical security surveillance of critical infrastructure and other national security purposes.

2024: Court challenge

In Hikvision USA v. FCC, the DC Circuit sent back part of the FCC's order, requiring it to reconsider how it had defined "critical infrastructure." Cooley has a summary of the decision.

October 2025: Second Report and Order

The FCC's Second Report and Order (FCC 25-71), adopted on 28 October 2025, set out a process for stopping the continued importation and marketing of covered equipment that had already been authorized, without affecting its continued use. It also stopped permissive changes to previously authorized covered equipment. The FCC gave 26 December 2025 as the date the rules took effect.

July 2026: Third Report and Order

The FCC adopted a Third Report and Order and Further Notice (FCC 26-50) on 22 July 2026 and released it the following day. Among other things, it addresses devices containing certain logic-bearing components from Covered List entities, and it revises the "critical infrastructure" definition. It also describes interpretations tied to the 16 critical infrastructure sectors and the National Critical Functions. Industry summaries report that the component rules took effect on 13 October 2026, and that software and firmware are not treated as covered components under this order. The order also includes further proposals, such as a wider ban on any component from a Covered List entity, which may or may not become final rules.

This summary touches only parts of a long document. For anything important, read it in full or ask counsel for help. Also check the FCC Covered List page for the current position.

Does a customer have to rip out existing cameras?

Based on the material we reviewed, the FCC's orders describe continued use of previously authorized equipment, and we did not find a requirement that ordinary private users remove installed Hikvision or Dahua cameras. The FCC's further proposals could change things, and customers with federal money or contracts may face a different answer under Section 889.

So be careful about how you present this. Telling a private customer that their cameras are "illegal" is likely to be wrong and could damage your credibility. Tell them what the rules cover, encourage them to ask their lawyer if they have federal ties, and offer an upgrade on its merits.

The white-label problem

Compliance gets harder because a brand on the label may not be the true manufacturer. Some equipment sold under other names has been made by named companies or uses their components. The FCC's attention to components shows this is a live concern.

So do not settle for a brand name, a badge or a line in a data sheet saying "NDAA compliant". Ask who made the device and its key components, and ask for that in writing.

A practical compliance workflow

Step 1: Ask about the customer's status

Add these questions to your sales process, even for private customers:

Do you hold, or plan to bid for, any federal contracts or subcontracts?
Is any federal grant or loan funding this project?
Does your contract require specific flow-down clauses?
Do you have a list of approved or prohibited equipment?

Note the answers against the lead so that the person writing the quote can see them.

Step 2: Build the bill of materials

List everything with electronics: cameras, recorders, encoders, switches, wireless links and video analytics devices. "Only the cameras" is a common oversight. Include any existing equipment you are reusing.

Step 3: Collect supplier evidence

For each model, ask the manufacturer or distributor for a signed letter that:

names the exact models and versions
addresses Section 889 specifically
says who manufactured the product and key components, as far as they can state
has a date and an authorized signature

Date these letters, and refresh them for new purchases. Supplier evidence helps, but it does not transfer your legal responsibility.

Step 4: Check the Covered List

Check the FCC list, plus any list specified in your contract. Also check for FCC authorization of new products in the FCC's equipment database, using the FCC ID on the product.

Step 5: Keep the paper trail

Keep a file for each project: the bill of materials, supplier letters, the customer's written requirements and the serial numbers installed. Attach these to the job record to keep them together. Our handover checklist shows what to add at the end of a job.

Step 6: Control substitutions

Substitutions are where well-prepared projects go wrong. If an item goes out of stock and a technician buys something similar locally, your compliance position may change. Require approval for any substitution on a sensitive project, and record it.

Step 7: Word your quotes with care

State what you are supplying and what documentation you are relying on. Avoid sweeping promises. "Models listed have been confirmed by the manufacturer as compliant with Section 889, per the attached letter" is safer than "fully NDAA compliant system".

Questions to ask your supplier

Is this model manufactured by, or does it contain components from, any entity named in Section 889 or on the FCC Covered List?
Who made the system-on-chip and any communications modules?
Can you give me a signed letter that covers this exact model and firmware?
What is its FCC ID?
What will you do if the product's status changes after purchase?

Don't forget state and local rules

Some states and other bodies have their own restrictions on certain equipment, and customers may have their own policies. Federal rules are not the whole picture, so ask your customer and, where needed, your lawyer.

Good cybersecurity still matters

Compliance does not mean secure. A compliant camera with a default password on an exposed network is still a risk. Change default credentials, keep firmware updated, separate the camera network and limit remote access, as you would for any customer.

Summary

Work out which rules apply to this customer. Identify everything in the system and who made it. Get the evidence in writing, keep it with the job and don't let substitutions undo your work. Keep claims specific, and bring in counsel when a federal contract or grant is involved.