NDAA compliant security cameras, explained properly

Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 — Public Law 115-232, signed 13 August 2018 — contains two separate prohibitions. They took effect a year apart, they bind different conduct, and almost every summary of "the NDAA camera ban" collapses them into one. The distinction is the whole ballgame, because it decides whether the law reaches only what you sell to the government or reaches every camera you own.

That is why Part B catches people. A distribution centre that has never sold anything to a federal agency, bidding for its first federal contract, discovers that the cameras installed over its own loading dock six years ago put the bid at risk. The equipment was never in scope of anything federal. Under Part B, that does not matter — what matters is that the entity uses it.

Both prohibitions are implemented through the Federal Acquisition Regulation at subpart 4.21, and the clauses a contractor actually encounters are FAR 52.204-24 and FAR 52.204-26, which are the representations you make about covered equipment, and FAR 52.204-25, which is the prohibition clause itself and carries the requirement to flow the obligation down to subcontractors.

Section 889(f)(3) defines covered telecommunications equipment by naming companies. Reproducing that list is a citation of federal law, and the list is not a judgment this page is making about any company. It is worth reading the two subparagraphs separately, because they are not written the same way.

• Subparagraph (A) — Huawei Technologies Company and ZTE Corporation, including subsidiaries and affiliates. This prohibition is written broadly, covering telecommunications equipment generally, not for particular purposes.
• Subparagraph (B) — Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company, including subsidiaries and affiliates. Here the statute qualifies the prohibition: it applies to video surveillance and telecommunications equipment for the purpose of public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes.
• Subparagraph (C) extends the definition to telecommunications or video surveillance services provided by those entities, or provided using their equipment.
• Subparagraph (D) is the reason the list of five is not permanent. It captures equipment or services from any entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the FBI, reasonably believes to be owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Two practical consequences follow. First, "is this brand on the list?" is the wrong question to stop at, because subparagraph (D) means the list can grow and because subsidiaries and affiliates are included without being named. Second, the qualification in subparagraph (B) is real but is not a loophole worth building a purchase around: most reasons an organisation is installing cameras — securing a facility, watching a perimeter, protecting infrastructure — land inside the purposes the statute enumerates.

Why the brand on the bezel does not answer the question

Section 889 is written about the entity that produced the equipment. The name printed on the housing is a commercial decision, and the two are frequently not the same thing. This is where careful buyers still get caught.

• OEM and relabelling, in general. Large manufacturers produce hardware sold under other companies' brands. Checking an unfamiliar brand against the five named entities can therefore return a clean answer while the equipment was produced by a named one. The brand check is not a compliance check.
• Subsidiaries are already included. The statute captures subsidiaries and affiliates without naming them individually. Where a manufacturer's own corporate disclosures state that a consumer brand is its subsidiary — as Hikvision's do for EZVIZ — the relationship is a matter of public company record rather than inference. Verified as of 25 August 2026.
• Ownership changes, and so does status. Lorex is the instructive worked example: it was acquired by Dahua from FLIR in February 2018 and subsequently sold to a different owner, Skywatch, in November 2022, per the companies' own announcements. A status determined before that sale and a status determined after it are different answers about the same brand — which is why undated compliance claims are worth little. Verified as of 25 August 2026.
• What this page will not do. Assert that a particular reseller brand is non-compliant on the basis of a forum thread, a teardown photograph or a family resemblance in a product line. Where a producer relationship is not established by the manufacturer's own disclosure or a government source, the correct output is "verify with the manufacturer", and that is what we write.
• Chipsets are a separate, unsettled question. A camera from an uncovered manufacturer can contain a system-on-chip designed by a subsidiary of a named entity — HiSilicon is a Huawei subsidiary, and was widely used across the industry. Whether a component makes the finished device "produced by" that entity is not cleanly settled in the text, and many manufacturers migrated to other silicon, and not argue it. Ask what is inside, and expect your contracting officer to take the conservative reading.
• The reliable move. Stop trying to derive the answer from the brand. Get a written attestation that identifies the actual producer and states the product falls outside Section 889(f)(3), for the specific models and the specific date you are buying.

What "NDAA compliant" means when you are actually buying

There is no federal certification body that tests a camera and issues it an NDAA compliance mark. No government agency maintains an approved product list for NDAA compliant security camera systems. "NDAA compliant" is a phrase the industry adopted to mean "this product is not covered equipment under Section 889" — useful shorthand, but shorthand that carries no independent verification with it.

What that means for a buyer is that the burden of establishing the fact sits with you, and that a claim on a product page is a starting point, not evidence. The things that function as evidence are narrower and more boring:

• Written manufacturer attestation. A letter or statement, on the manufacturer's letterhead, identifying the models and stating that they are not covered telecommunications equipment under Section 889(f)(3). Ask for it before purchase, keep it, and note its date.
• Your own representations. The FAR 52.204-24 and 52.204-26 representations are what your organisation formally asserts. They should be traceable to an inventory and to attestations, not to a general impression that the estate is fine.
• The FCC Covered List. A published government source identifying communications equipment determined to pose an unacceptable national security risk, including the video surveillance entities named in Section 889. It confirms the negative side of the question and is checkable.
• Country of origin documentation. Not the Section 889 test — but you will need it if TAA also applies, and it is far easier to obtain at the point of purchase than to reconstruct two years later.
• The actual clauses in your contract. Which obligations apply is decided by the clauses in the specific contract or award, not by a general understanding of the law. Read them, or have someone read them.

Where a system is being specified, not bought off a shelf, the cheapest time to resolve all of this is at design. Three questions this page only summarises have their own pages: what Section 889 says and who it binds, the separate Trade Agreements Act test, and door-station and intercom equipment, which is the component most often missed. Compliance is a constraint on the equipment schedule in the same way that resolution, low-light performance and cable distance are — and it is much less expensive to apply as a filter than to discover as a defect. That is how we approach it on commercial security camera installation for government and defence-adjacent sites.

San Diego CCTV Pros is a DBA of Guardian Integrated Security, Inc. We design and install NDAA-compliant camera, access control and intercom systems for government and defence-adjacent facilities, and we hold the credentials that matter on that work: CMMC certified and C3PAO assessed, registered in SAM.gov, CSLB #976737 as a C-7 low voltage contractor, and a BSIS Alarm Company Operator licence, ACO #7501. We do not hold a C-10 or a C-16, so fire alarm work is coordinated with your licensed fire alarm contractor, not performed by us.

This page names manufacturers because the statute does, and it names them neutrally. Nothing here is a claim about any company's conduct, and nothing here is legal advice — compliance obligations are set by the clauses in your own contract, and the questions that carry real consequences belong with your counsel and your contracting officer. Everything status-dependent on this page was verified as of 25 August 2026and should be re-checked before you rely on it.

What we can do is the practical half: survey what is installed, identify what it actually is, specify replacements that clear the tests your contract imposes, and hand over the documentation that lets you answer the question next time. See the full range of commercial security and low voltage services.