Government & defense
Government and defense security systems in San Diego
Federal facilities, military installations and defense contractors — where the equipment has to clear Section 889 before anyone looks at the image quality, and the documentation has to survive an audit. CMMC certified, C3PAO assessed, SAM.gov registered.
Government & Defense
The equipment has to clear procurement before anyone looks at the picture
On a commercial site the security conversation starts with what the building needs and ends with what it costs. On a federal or defense- adjacent site there is a stage in front of both, and a system that fails it is not a system you can install however good it is. Section 889 decides the equipment schedule, and it decides it before image quality, before layout, before price.
That is why the requirements which actually determine the outcome tend to be the boring ones, and why they get missed. They are not about the technology. They are about whether the hardware and its components are permissible, whether the documentation will survive an audit, whether your integrator is part of your own compliance position, and whether the work can be delivered inside a procurement process rather than around it.
We hold CMMC certification and are SAM.gov registered, and we are used to working to a specification somebody else owns. Where the footage itself is controlled, storage and access become part of the requirement rather than an implementation detail, and the design has to reflect that from the start.
What we will not do is tell you what your obligations are. Those belong to your security officer and your contracting officer. We will tell you plainly whether a given product line is inside or outside Section 889 and what the documentation for it looks like, which is the part we are actually in a position to know.
That is with us. We will come back to arrange a survey. If it is urgent, call (858) 222-7547.
- CSLB C-7 #976737
- BSIS ACO #7501
- CMMC certified
- SAM.gov registered
- Est. 2008
The buyer's problem
The system has to clear procurement before it has to work
On a commercial site, the security conversation starts with what the building needs and ends with what it costs. On a federal or defense-adjacent site, there is a stage in front of both of those, and it disqualifies most of the market before anyone evaluates a camera: can the equipment lawfully be bought, and can that be evidenced.
The requirements that actually decide the outcome are boring, which is part of why they get missed. They are not about the technology at all:
- Equipment provenance. Who produced each device, evidenced in writing and dated — not inferred from the brand on the housing.
- Supply-chain accountability. Increasingly the vendors touching the facility are themselves part of what the contractor has to account for, which is what CMMC formalises.
- Audit-survivable documentation. As-builts that match reality, test records per link, and compliance attestations retained with their dates.
- Chain of custody. Who handled the equipment, who configured it, who holds the credentials, and what happens to recorded material — questions a commercial site rarely asks and this one always does.
- Personnel and site conditions. Badging, escort requirements and site briefings treated as ordinary conditions of the work, not as friction.
- A procurement process that has its own shape. Bids, scopes written to be comparable, and timelines that do not bend to a contractor's schedule.
What follows maps each of those to how the work is actually done, and to the service that carries it.
Section 889 decides the equipment schedule
This is the single requirement most likely to disqualify a system, and the one most often discovered late. We maintain the full explainer as a standalone resource — NDAA compliant security cameras and Section 889 — because the detail matters more than a vertical page can carry. The rest of that set, door-station equipment and the separate TAA test included, is under compliance.
Part A and Part B are different problems
Part A stops agencies procuring covered equipment. Part B stops them contracting with entities that use it, anywhere in their own operations. A contractor's own warehouse cameras are a Part B question even though nothing federal ever touched them.
The statute names producers, not countries
Country of manufacture is the Trade Agreements Act test, not this one. Conflating them causes buyers to reject compliant equipment and, worse, to accept equipment that clears the country question and fails the entity one.
The brand is not the producer
Hardware is routinely sold under names other than the manufacturer's. Checking an unfamiliar brand against the named entities can return a clean answer while the equipment was produced by a covered one — which is why we work from written attestations.
Applied at design, not at handover
Compliance is a constraint on the equipment schedule in the same way resolution and cable distance are. Filtering at design costs nothing; discovering it at commissioning means re-specifying, and discovering it after installation means replacing.
Intercoms and door stations count
An IP video door station is telecommunications equipment and video surveillance equipment at once. It is the component most often missed, because it was bought under an access project.
Status is dated, not permanent
Ownership changes and statutory additions both move products across the line. An attestation is evidence of a position on a date, which is why we record the date alongside it and re-check it — never just assume.
The usual order, inverted
An excellent specification is worthless if the equipment cannot be bought
A specification that would be excellent anywhere else is worthless here if the equipment is covered under Section 889, if the country of origin fails a Trade Agreements Act clause, or if the integrator cannot produce the documentation to demonstrate either.
Facility managers in this position have usually learned it the expensive way — a system installed under a previous policy, or by a contractor who answered the technical question and never heard the procurement one.
What Section 889 actually prohibits
Where we work
Facility types
San Diego's defense presence is one of the county's defining industries, and the facilities that carry federal obligations are more varied than the phrase "government site" suggests.
Military installations
Work on installations runs to the facility's own conditions — badging, escort, site briefings and access windows — and to specifications that treat equipment provenance as a threshold requirement.
Federal and civic buildings
Offices, courts and administrative facilities, where the emphasis shifts toward controlled-area access, visitor handling and an audit trail that shows who went where and when.
Defense contractors
The largest category by count, and the one where Part B most often bites: a private company whose own premises now have to satisfy a federal requirement because of what it bids on.
Research and laboratory facilities
Controlled areas inside otherwise open buildings, where the design problem is granular access control and a defensible record of entry.
Port, border and logistics facilities
San Diego's Otay Mesa corridor puts cross-border freight operations alongside federally regulated activity, and the security requirements frequently arrive through the customer or the regulator, not through a contract.
Supporting industrial sites
Fabricators, machine shops and suppliers in the Kearny Mesa, Miramar and East Village areas who hold subcontracts and inherit the obligation through flow-down — usually discovering it when a representation request arrives.
Controlled areas
Access control, visitor management and credentialing
On these sites access control stops being a convenience feature and becomes the evidence layer. The question is not whether a door opens for the right people; it is whether you can demonstrate afterwards who entered a controlled area, on whose credential, and at what time — and whether that record is trustworthy enough to rely on.
- Controlled areas inside open buildings. The common design is not a hardened perimeter but a graded one: general areas, restricted areas and controlled areas, each with its own credential rules and its own retention expectations for the audit trail.
- Credential lifecycle, not credential issue. Issuing a badge is easy. What matters is revocation being immediate and provable, temporary credentials that expire on their own, and the record showing what a credential could open at the time it was used.
- Visitor and contractor handling. Escort requirements, time-bounded access, and a record that ties a visitor to a sponsor. This is where paper systems fail audits most often.
- Tailgating is a documentation problem. A credential record says a door was opened, not who walked through it. Pairing access events with camera coverage of the same door is what turns an assertion into an observation.
- Egress is life safety and is not negotiable. People must be able to get out whether or not the system has power. That is designed in from the start, and the interface to the fire system is coordinated with your fire alarm contractor, not touched by us.
The design and installation side of this is covered under commercial access control, and the door-position cabling and pathways under structured cabling.
Camera systems where the footage is itself controlled
A camera system on a sensitive site introduces a problem it does not create anywhere else: the recorded material becomes something that has to be protected in its own right. Coverage decisions therefore run in both directions — what has to be seen, and what must not be recorded or must not leave the site.
- Coverage is bounded deliberately. Field of view is a design decision about exclusion as well as inclusion. Positions are chosen so that a camera covering an approach does not incidentally capture what is on a screen, a bench or a whiteboard inside a controlled area.
- Where the recording lives matters. On-premise retention, network segmentation, and who can reach the recorder are architecture questions on these sites, not preferences. Cloud-by-default is frequently the wrong answer here.
- Access to footage is a controlled function. Who can view, who can export, and whether an export is logged — the same audit-trail logic that applies to doors applies to recorded material.
- Retention is set by policy, not by disk size. True retention and configured retention diverge quietly as a system ages. On an audited site that divergence is a finding.
- Equipment provenance applies to recorders too. Section 889 is not a camera-only question. Recorders, encoders and management software are inside the same analysis.
New coverage is designed and installed under commercial security camera installation. Where a facility needs eyes on a site during unoccupied hours — a phased replacement, a construction phase, a perimeter nobody is standing on — that is remote video monitoring, and intrusion detection with video verification sits under commercial alarm monitoring.
Supply chain
CMMC, and why your integrator is part of your compliance problem
The Cybersecurity Maturity Model Certification framework exists because the Department of Defense concluded that protecting controlled unclassified information could not stop at the prime contractor. Responsibility runs down the supply chain, which means a defense contractor is accountable for the vendors who touch its facilities, its networks and its data — and a security integrator touches all three.
Practically, this is what it changes for a contractor evaluating us:
- Vendor due diligence is shorter. The assessment exists and can be discussed, not being a questionnaire exercise conducted from scratch.
- Network-touching work is a smaller conversation. Camera systems, access control and recording platforms all live on infrastructure, and who is allowed to configure them is a live question on these sites.
- The registration is already done. SAM.gov registration is in place, so eligibility is not a thing to arrange once a requirement appears.
- The gaps are stated. No GSA schedule, no set-aside status. Both are said up front because both are real constraints for some buyers.
How the work is bought
Working inside a procurement process
Federal and federally funded work is bought differently from commercial work, and an integrator who treats a bid like a quote wastes everybody's time. The differences are procedural, not technical, and they are learnable.
- Scopes have to be comparable. A specification written so that three bidders are pricing the same thing is more useful to the buyer than a clever proposal that cannot be evaluated against anything.
- Representations are formal. The compliance statements made in a bid are commitments, and they should be traceable to attestations and an inventory.
- Flow-down is real. Where we hold a subcontract, the obligations pass to us the same way they passed to the prime, and we expect to evidence that, not assert it.
- Timelines belong to the facility. Access windows, escort availability and operational constraints set the schedule. Work is sequenced around them.
- Existing systems get assessed, not condemned. A survey that reports what is serviceable alongside what is not is more useful — and cheaper — than a proposal to replace everything. That assessment runs under CCTV maintenance and repair.
Documentation that survives an audit
The test is simple and unforgiving: can somebody who has never visited the site answer a question about it in two years without opening a ceiling. Most systems we take over fail it.
As-builts that match reality
Drawings reflecting what was installed, not what was designed. The difference between the two is where every later dispute starts, and it is the cheapest thing in the world to get right at the time.
Device and port schedules
Every device identified, located and tied to the port it lands on, with a labelling scheme that is documented, not improvised. This is what makes an estate auditable — not merely present.
Certified test records
Every permanent cabling link tested to standard and the results handed over per link, identified by label — not a continuity check, and not a statement that it works.
Compliance evidence, dated
Equipment attestations retained with the date they were obtained, so a representation can be traced to a document.
Configuration and credential records
What was configured, by whom, and who holds administrative access — established at handover, not reconstructed after a personnel change.
It is yours
The documentation is handed over as your property. An integrator who keeps the only accurate record of your estate has made you dependent on them, and that is a procurement problem as much as a technical one.
Assessed, not self-attested
The distinction between assessed and self-attested is the whole point
A self-assessment is an organisation's account of itself. A C3PAO assessment is a certified third-party assessment organisation examining that account against the standard.
For an integrator of this size, having been through the second is uncommon, and it is the item that most often removes the question of whether a vendor can be brought onto a site at all.
The entity behind the certification
Credentials
What we hold, and what we do not
San Diego CCTV Pros is a DBA of Guardian Integrated Security, Inc., and that relationship is how the credentials below attach. We have been operating since 2008, and we have completed work for military and federal facilities.
- CMMC certified, C3PAO assessed. Assessed by a certified third-party organisation, not self-attested.
- SAM.gov registered. The administrative prerequisite for federal award eligibility is in place.
- CSLB #976737 — a C-7 Low Voltage Systems contractor's licence, covering camera, cabling and intercom installation. Verify at cslb.ca.gov.
- BSIS ACO #7501 — an Alarm Company Operator licence, covering monitored CCTV, alarm and access-control work. Verify at bsis.ca.gov.
- BSIS PPO #121089 — held by Guardian Integrated Security, Inc. for guard and patrol services. Posted guards are that operation's line of work, coordinated with us — not provided by us.
And the exclusions, stated because assuming them is expensive. We do not hold a C-10 or a C-16, so fire alarm work is coordinated with your licensed fire alarm contractor. We hold no GSA schedule and no set-aside designation. We do not claim clearance levels. Where any of those is a requirement, it is better established before a scope is written than after.
The NDAA explainer that supports this page is maintained separately and in more depth — start at NDAA compliant security cameras if compliance is the immediate question. The full range of work is on the commercial services page, and the other verticals we build for are listed under industries.
Common questions
Government and defense security questions
Less about the cameras than most buyers expect, and more about what can be evidenced. A system suitable for this environment has to clear procurement gates before anyone evaluates image quality: equipment that is not covered under Section 889 of the FY2019 NDAA, country-of-origin documentation where a Trade Agreements Act clause applies, and a paper trail that survives an audit, not just a walkthrough. Then come the operational requirements — controlled-area access with a real audit trail, visitor and credential handling, and as-built documentation accurate enough that the next contractor is not guessing. A technically excellent system that fails the first gate is not a candidate.
Yes. San Diego CCTV Pros operates as a DBA of Guardian Integrated Security, Inc., which is CMMC certified and was assessed by a C3PAO — a certified third-party assessment organisation — not self-attested. For an integrator of this size that is uncommon, and it matters for a specific reason: Department of Defense contractors are responsible for their supply chain, so the vendors touching their facilities and their networks become part of what they have to account for. A vendor that has been through a third-party assessment is a materially different proposition from one that has filled in a form about itself.
Yes. Registration in the System for Award Management is the baseline requirement for doing business with the federal government, and it is in place. It is worth being precise about what that does and does not mean: SAM registration makes an entity eligible to be awarded federal contracts. It is not a set-aside status, not a schedule, and not a preference. It means the administrative prerequisite is handled. It becomes a delay only once a requirement is identified.
No, and we would rather say so directly than let it be assumed. We do not hold a GSA Multiple Award Schedule, and we do not hold 8(a), SDVOSB, HUBZone or any other socioeconomic set-aside designation. If your requirement has to be filled through a schedule or against a set-aside, that is a real constraint and we will tell you at the first conversation, not after you have invested time in a scope. Where we work is direct contracts, subcontracts to primes, and work for contractors who carry federal obligations of their own.
It operates as a gate, not a preference. Section 889 prohibits federal agencies from procuring covered telecommunications equipment, and separately from contracting with entities that use it — so for a facility inside that scope, a camera from a covered producer is disqualifying regardless of how well it performs or what it costs. The practical consequence is that compliance is a filter applied to the equipment schedule at design, before anything is priced. Applying it afterwards means re-specifying, and applying it after installation means replacing.
That is one of the more common ways this work starts. The sequence is an inventory of what is physically installed, identification of the actual producer of each device — not the brand printed on it — and a written record of what was found and when it was checked. What you get out of it is a documented position — which is a materially different thing to hold at a bid or a renewal than an untested assumption. Where equipment does need replacing, that gets scoped as a phased plan against your contract exposure.
They are separate statutes with separate tests, and a product can pass one and fail the other. Section 889 asks who produced the equipment — it names specific entities. The Trade Agreements Act asks where the product was made or substantially transformed, and requires it to be a designated country. A camera from an unnamed manufacturer built in a non-designated country satisfies Section 889 and fails TAA. If your contract carries both clauses, both have to be cleared, and a vendor who answers only one has not answered the question.
As-built drawings reflecting what was actually installed, not what was drawn, device schedules identifying each unit and its location, rack elevations, the port-to-outlet schedule, certified test results for every cabling link, configuration records, and the compliance evidence — equipment attestations with the dates they were obtained. The test for whether documentation is adequate is simple and unforgiving: can somebody who has never been to the site answer a question about it in two years without opening a ceiling. That is the standard we work to, and it is the part most often missing from systems we take over.
Our personnel work under the licences the company holds, and BSIS registration as an alarm agent requires a DOJ/FBI background check via Live Scan before the state grants it — that is a BSIS requirement, not something we administer ourselves. Beyond that, facility access requirements are set by the facility, not by us — badging, escort requirements, site-specific briefings and any additional screening are conditions we meet as a matter of course, not negotiate. We will not overstate this: we do not claim clearance levels, and where a requirement calls for cleared personnel that is a condition to establish before scope is agreed, not after.
Not as our own service line. We are a licensed alarm and low voltage contractor — cameras, access control, alarm, monitoring and cabling. Guard services sit with Guardian Integrated Security, Inc. under its Private Patrol Operator licence, PPO #121089, and where a facility needs a posted presence that is coordinated, not presented as something we do. We would rather draw that boundary plainly at the outset than have it discovered during an incident.