Section 889 explained
What is NDAA Section 889?
Section 889 of the 2019 National Defense Authorization Act contains two separate prohibitions that took effect a year apart and bind different conduct. Almost every summary collapses them into one. The distinction is what decides whether the law reaches only what you sell to the government, or reaches every camera you own.
- CSLB C-7 #976737
- BSIS ACO #7501
- CMMC certified
- SAM.gov registered
- Est. 2008
The statute
Two prohibitions, one section
Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019, Public Law 115-232, signed on 13 August 2018, contains two prohibitions that are routinely discussed as if they were one rule. They are not. They took effect a year apart, they bind different conduct, and the difference between them is the whole of the practical question.
Part A: what the government buys
Section 889(a)(1)(A), effective 13 August 2019. Executive agencies may not procure or obtain, or enter into a contract to procure or obtain, covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology of any system. This is the prohibition people expect when they hear about the ban: the government will not buy the equipment.
Part B: what you use
Section 889(a)(1)(B), effective 13 August 2020. Executive agencies may not enter into, extend or renew a contract with an entity that uses covered equipment or services as a substantial or essential component of any system, or as critical technology of any system.
Nothing in Part B requires the equipment to have been sold to the government, bought with federal money, or used on federal work. It attaches to the contractor as an organisation. That is why Part B is the part that catches people: a distribution centre that has never sold anything to a federal agency, bidding for its first federal contract, can discover that cameras installed over its own loading dock years ago put the bid at risk. The equipment was never in scope of anything federal. Under Part B, what matters is that the entity uses it.
Neither date is a grace period for equipment already installed. Part B attaches to present use, so a camera bought in 2017 is inside the scope of a representation you make today.
The named entities
Who the statute names, and how it names them
Section 889(f)(3) defines covered telecommunications equipment by naming companies. Reproducing that list is a citation of federal law. It is not a judgement this page makes about any company, and the two subparagraphs are not written the same way.
Subparagraph (A)
Huawei Technologies Company and ZTE Corporation, including subsidiaries and affiliates. This prohibition is written broadly, covering telecommunications equipment generally rather than equipment used for particular purposes.
Subparagraph (B)
Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company, including subsidiaries and affiliates. Here the statute qualifies the prohibition: it applies to video surveillance and telecommunications equipment used for public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes.
Subparagraph (D)
The reason the list of five is not permanent. It captures equipment or services from any entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the FBI, reasonably believes to be owned or controlled by, or otherwise connected to, the government of a covered foreign country.
Scope
Who is actually bound
Two consequences follow. "Is this brand on the list?" is the wrong question to stop at, because subparagraph (D) means the list can grow and because subsidiaries and affiliates are included without being named individually. And the qualification in subparagraph (B) is real but is not a loophole worth building a purchase around.
The prohibition is written against federal agencies, but it reaches far past them, because agencies enforce it by declining to contract with anyone who fails it. That turns a procurement rule into a supply-chain obligation, and it travels by two routes.
Through contracts. Both prohibitions are implemented through the Federal Acquisition Regulation at subpart 4.21. FAR 52.204-24 and FAR 52.204-26 are the representations you make about covered equipment. FAR 52.204-25 is the prohibition clause itself, and it carries a flow-down requirement, so the obligation passes from prime to subcontractor and onward. A firm several tiers from any agency can hold the same duty as the prime, and usually discovers it when a representation request arrives.
Through federal awards. A parallel restriction at 2 CFR 200.216 prohibits recipients and subrecipients from using federal award funds to procure covered equipment. That is what brings universities, school districts, municipalities, transit agencies and hospitals into scope, and it travels with the money even where the buyer is a city that holds no federal contract of its own.
Which of these applies to you is decided by the clauses in your specific contract or award. Not by a general understanding of the law, and not by this page.
The vocabulary problem
"NDAA compliant" is not a certification
There is no federal certification body that tests a camera and issues it an NDAA compliance mark, and no government agency maintains an approved product list for NDAA compliant security cameras. The phrase is industry shorthand for "this product is not covered equipment under Section 889". Useful shorthand, but shorthand that carries no independent verification.
The practical consequence is that the burden of establishing the fact sits with you, and a claim on a product page is a starting point, not evidence. What functions as evidence is narrower:
- A written manufacturer attestation identifying the models and stating that they are not covered equipment under Section 889(f)(3).
- Your own FAR representations, traceable to an inventory rather than to an impression.
- The FCC Covered List, as a published government source that confirms the negative side of the question.
Two traps sit underneath the vocabulary.
- The brand is not the producer. The name on the bezel does not identify who built the hardware, and the statute is written about the producer, so a clean brand-list check can still leave you holding covered equipment — specifying and verifying compliant equipment covers how to close that.
- Country of manufacture is a different test. It sits under a different statute, which is the TAA question and not this one. A product can satisfy Section 889 and still fail TAA.
On waivers: the statute contained limited provisions, including a one-time agency waiver for Part B whose availability ran to 13 August 2022. It is not a route to plan around today.
Where we fit
What we do with this, and what we will not tell you
San Diego CCTV Pros is a DBA of Guardian Integrated Security, Inc. We design and install camera, access control and intercom systems for government and defence-adjacent facilities in San Diego County, and we hold the credentials that matter on that work: CMMC certified and C3PAO assessed, registered in SAM.gov, CSLB #976737 as a C-7 low voltage contractor, and a BSIS Alarm Company Operator licence, ACO #7501. We do not hold a C-10 or C-16, so we do not work on fire alarm systems; that is coordinated with your own licensed fire alarm contractor. We work on commercial premises only and not on private residences.
This page names manufacturers because the statute does, and it names them neutrally. Nothing here is a claim about any company's conduct, and nothing here is legal advice. Compliance obligations are set by the clauses in your own contract, and the questions that carry real consequences belong with your counsel and your contracting officer. Everything status-dependent on this page was verified as of 25 August 2026 and should be re-checked before you rely on it.
What we can do is the practical half: survey what is installed, identify what it actually is, specify replacements that clear the tests your contract imposes, and hand over the documentation that lets you answer the question next time. If procurement policy applies to a door-entry project instead of a camera one, the same reasoning runs through intercom and door-station equipment, which is covered on its own page. The wider service set is on all commercial security and low voltage services.
Common questions
Section 889 questions
Two things, not one. Part A prohibits federal executive agencies from procuring covered telecommunications equipment or services as a substantial or essential component of any system. Part B prohibits those agencies from entering into, extending or renewing a contract with any entity that uses such equipment, anywhere in that entity’s own operations, whether or not the equipment has anything to do with the federal work. Almost every summary that describes "the NDAA camera ban" as a single rule has collapsed the two, and the distinction decides whether the law reaches only what you sell to the government or reaches every camera you own.
Part A, the procurement prohibition at 889(a)(1)(A), took effect on 13 August 2019. Part B, the use prohibition at 889(a)(1)(B), took effect a year later on 13 August 2020. Both dates matter when you are looking at an existing estate, because equipment installed before either date is not exempt: Part B attaches to the fact that the entity uses the equipment now, not to when it was purchased. A camera bought in 2017 is squarely in scope of a representation you make today.
No, and this is worth being blunt about because the whole market speaks as though it is. There is no federal certification body that tests a camera and issues it an NDAA mark, and no government agency maintains an approved product list. Section 889 is a prohibition addressed to agencies and, through the contract clauses, to the entities that deal with them. "NDAA compliant" is industry shorthand meaning "this product is not covered equipment under Section 889". It is useful shorthand, but it carries no independent verification, which is why a written manufacturer attestation naming the specific models is the thing worth having and a claim on a product page is not.
Both prohibitions are implemented through the Federal Acquisition Regulation at subpart 4.21. The clauses a contractor actually encounters are FAR 52.204-24 and FAR 52.204-26, which are the representations you make about covered equipment, and FAR 52.204-25, which is the prohibition clause itself and carries the requirement to flow the obligation down to subcontractors. For federal awards, not federal contracts, the parallel restriction sits at 2 CFR 200.216. Which of these applies to you is decided by the clauses in your specific contract or award, not by a general understanding of the law, so the practical first step is always to read them.