FCC Covered List and Secure Networks Act Guide: Equipment Bans, Rip-and-Replace and Procurement Checks

The FCC Covered List decides which communications equipment and services can be funded, authorised and, in practice, bought in the United States, yet many security and procurement teams only meet it when a tender or an audit asks for a certification. The list was created by the Secure and Trusted Communications Networks Act of 2019 (the Secure Networks Act) and is maintained by the FCC's Public Safety and Homeland Security Bureau. It now drives four separate legal effects: a ban on FCC subsidies for covered gear, a reimbursement programme to rip and replace it, an annual reporting duty for providers, and a ban on new equipment authorisations. Federal contractors face an overlapping rule under section 889 of the FY2019 NDAA. This guide is for telecom operators, enterprise network and procurement teams, and product vendors. Status line: list entries and dates below are as shown on the FCC Covered List page when read on 27 October 2026, which displayed an "updated" date of 3 September 2024.

Key takeaways

• The list is determination driven. The FCC adds equipment or a service only when one of four national security determinations named in 47 U.S.C. 1601(c) supports it and the item has the capabilities in 1601(b)(2); the FCC does not make the security judgement itself.
• Eleven entries, mostly Chinese vendors plus Kaspersky. Huawei, ZTE, Hytera, Hikvision and Dahua were listed on 12 March 2021; Kaspersky and three Chinese carriers' Section 214 services followed in 2022, and Kaspersky Lab, Inc. software in July 2024.
• Four legal effects, different audiences. Subsidy ban (47 U.S.C. 1602), rip-and-replace reimbursement (1603), annual provider reporting (Section 5, rule 1.50007) and the equipment authorisation ban (47 CFR 2.903) each bind different parties.
• Enterprises are caught indirectly. Private companies can still own listed gear, but new models cannot be authorised, and federal contractors must not use covered equipment at all under FAR 52.204-25, with a one business day reporting clock.
• Treat it as an inventory problem. Compliance depends on knowing every router, camera, radio, embedded module and security agent you run, including the software agents and device identities that sit inside them.

Scope: who and what is covered

Section 2 of the Secure Networks Act (47 U.S.C. 1601) requires the FCC to publish a list of "covered communications equipment or services". An item goes on the list only if it meets both limbs of the test, and listing a producer or provider also covers its subsidiaries and affiliates, according to the FCC page.

The entries as published

Note the conditional wording for Hytera, Hikvision and Dahua: the entries apply to particular uses, not every camera sold. Entry 11 is the first that is pure software running on endpoints, which pulls security agents into scope alongside network hardware. We could not confirm whether any entries were added after 3 September 2024; check the live FCC page before relying on this table.

Key obligations

The Covered List is a pivot that several separate rules point at. Work out which of them binds you before you plan anything.

The equipment authorisation ban in detail

• Modules count: 47 CFR 2.903(a) covers certified modular transmitters and those that could be certified as modular transmitters under 15.212.
• Composite devices: 2.903(b) bars a device that contains a covered modular transmitter together with a logic-bearing hardware component made by a Covered List entity, judged as if that entity had built the whole device.
• Affiliate thresholds: an affiliate shares ownership or control, with 10 percent equity treated as ownership; a subsidiary is one where another entity has de facto control or more than 50 percent of the voting stock (2.903(e)).
• Effective date: the FCC states covered equipment has been barred from authorisation since 6 February 2023, and on 3 September 2024 it announced a prohibition on authorising equipment that includes Kaspersky software.

Section 889 for federal contractors

FAR 52.204-25 (November 2021 clause) is separate law but uses the same five vendors. Part A, from 13 August 2019, stops agencies buying equipment that uses covered telecommunications as a substantial or essential component or critical technology. Part B, from 13 August 2020, stops agencies contracting with any entity that uses covered equipment, even where the use is unrelated to the contract. Exceptions cover third-party backhaul, roaming and interconnection, and equipment that cannot route or redirect user data or give visibility into it. If covered equipment is found, report within 1 business day and give mitigation detail within 10 business days; DoD reports go to dibnet.dod.mil. The clause flows down to subcontracts, except paragraph (b)(2).

Timeline and current status

Funding: the FCC programme page still describes a $1.9 billion programme, while the current text of 47 U.S.C. 1603(k) caps the programme at $4.98 billion. Read the statute as the current ceiling and check the FCC page for distribution status. Updates: the FCC must update the list as determinations change, remove an item if its supporting determination is reversed and no other supports it, and publish a notice for any 12-month period with no update (1601(d)).

Enforcement and penalties

• Communications Act treatment: a violation of the Act or its rules is treated as a violation of the Communications Act of 1934 and enforced as such (47 U.S.C. 1606(a)). Section 1606 itself sets no fine amounts.
• Reimbursement recipients: on a violation of section 1603, its rules or their commitments, a recipient must repay all funds, is barred from further participation, is referred to law enforcement and may be barred from other FCC programmes, including universal service support.
• Cure period: those additional penalties apply only if the recipient fails to cure within 180 days of the FCC's notice.
• Clawback: where repayment is due, the FCC must immediately act to recover the funds.
• Equipment authorisation: applications for covered equipment cannot be granted, and a false certification under 2.911(d)(5) is a filing made to the FCC.
• Federal contracts: the consequences of breaching FAR 52.204-25 sit in the contract and federal procurement law, not in the Secure Networks Act.

What it means for AI agents and non-human identities

The Covered List is about hardware and services, but the controls you need to prove compliance are largely about the machine identities those products carry and the automation that buys and runs them.

• Security agents are services with privilege: the Kaspersky entries cover anti-virus software and equipment with it integrated. Endpoint agents run as highly privileged local services with update channels and cloud credentials. Removing them means uninstalling the service, revoking its management console API keys and removing its certificates from trust stores, not just stopping the licence.
• Device certificates and management credentials: routers, radios and cameras hold SNMP communities, SSH keys, RADIUS secrets and device certificates. When rip-and-replace removes a box, rotate every shared secret it held, because the old device leaves with them. See the Device and IoT Identity Guide.
• Embedded modules hide inside other brands: 2.903(b) shows that a covered radio module can sit in a device badged by someone else. Device identity attestation (TPM or DICE based) and a hardware bill of materials help prove what is inside. See the IoT Device Identity with TPM and DICE Guide.
• Procurement automation: if purchasing bots or AI agents raise orders or approve catalogue items, give them a check against the current Covered List and section 889 entities as a hard gate, log the check, and keep a human approver for any network or security product.
• Provider and carrier services: the Section 214 entries are services, not boxes. Interconnect and transit contracts, SIM and IoT connectivity platforms and their API tokens should be part of the review.

Compliance steps

1. Classify your exposure. Decide whether you are an FCC subsidy recipient, a reimbursement recipient, an advanced communications service provider, an equipment applicant, a federal contractor, or simply a buyer. Each has a different rule from the obligations table.
2. Build the inventory. Pull manufacturer, model and firmware from the CMDB, network discovery, NAC and EDR. Include cameras, push-to-talk radios, small cell and Wi-Fi gear, and endpoint security agents. See the Asset Inventory and CMDB Security Guide.
3. Match against the list and its affiliates. Match on entity, subsidiaries and affiliates, and OEM relationships, not just the badge on the front. Record the use case for Hytera, Hikvision and Dahua items, since their entries depend on use.
4. Pilot remediation on one site. Replace in a single region or building first, test failover and monitoring, then roll out. Keep the old equipment powered down but in place until the replacement passes acceptance, so you can roll back service, not the policy.
5. Rotate and revoke. For every removed device or agent, rotate the secrets and keys it held, revoke its certificates and delete its management accounts.
6. Dispose properly. Reimbursement recipients must dispose of equipment in line with FCC rules; everyone else should wipe and destroy storage under a recorded process (NIST SP 800-53 SR-12).
7. Gate new purchases. Add a Covered List and section 889 check to supplier onboarding and to the catalogue, and require suppliers to certify. Re-check whenever the FCC updates the list.
8. Report on time. Providers file the annual certification (in recent years due 31 March); contractors report under the 1 business day and 10 business day clocks; reimbursement recipients file 90-day status updates.

Decision guidance

Detection, measurement and framework mapping

Monitor for covered gear appearing after the clean-up: NAC and DHCP fingerprint alerts for listed manufacturers' MAC address prefixes, EDR software inventory queries for listed agents, and purchase order screening.

• Inventory coverage: percentage of network and endpoint assets with a known manufacturer and model.
• Open covered items: count of covered devices or agents still in service, trending to zero.
• Credential hygiene: percentage of removed devices whose secrets and certificates were rotated or revoked within 7 days.
• Procurement gate: percentage of new network or security purchases with a recorded Covered List check.
• Reporting timeliness: filings and contractor reports made within their deadlines.

Common failure patterns

• Badge matching only: checking the front-panel brand and missing white-labelled cameras and OEM radio modules.
• Enclave thinking: federal contractors who remove covered gear from contract networks but leave it in offices, missing that section 889 Part B bans use by the entity.
• Licence lapse as removal: letting a security agent's licence expire while the privileged service, its updater and its keys remain on every endpoint.
• Secrets leave with the box: decommissioning routers without rotating shared RADIUS, SNMP and VPN secrets. Telecom intrusions such as those described in the Salt Typhoon Threat Actor Profile show how far network device credentials reach.
• Stale list copy: screening against a spreadsheet saved years ago instead of the live FCC page.

Practitioner checklist

• Record which Covered List rules apply to your organisation and who owns each one.
• Bookmark the live FCC Covered List and re-check it on every procurement cycle.
• Inventory network hardware, cameras, radios, modules and security agents with manufacturer and model.
• Match inventory against listed entities, subsidiaries and affiliates, and note the use case for conditional entries.
• Remove covered security agents and revoke their keys, certificates and console tokens.
• Rotate every secret held by removed network devices and delete their management accounts.
• Add a Covered List and FAR 52.204-25 check to supplier onboarding and purchasing automation.
• Keep evidence: inventories, match results, disposal records and filing receipts.
• Diarise the annual provider certification and the contractor 1 and 10 business day reporting clocks.

Standards and references

• FCC: List of Equipment and Services Covered by Section 2 of the Secure Networks Act
• US Code: 47 U.S.C. 1601, Determination of communications equipment or services posing national security risks
• US Code: 47 U.S.C. 1603, Secure and Trusted Communications Networks Reimbursement Program
• US Code: 47 U.S.C. 1606, Enforcement
• eCFR: 47 CFR 2.903, Prohibition on authorization of equipment on the Covered List
• eCFR: 47 CFR 2.911, Application requirements
• FCC: Protecting Against National Security Threats to the Communications Supply Chain
• Acquisition.gov: FAR 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment

This guide summarises the Secure and Trusted Communications Networks Act, the FCC Covered List and related FCC and FAR rules as published by official sources when read on 27 October 2026, and is not legal advice. Related NHI Mgmt Group resources: Telecom Network Security Guide · NIST SP 800-161 Cyber Supply Chain Risk Management Guide · FCC CPNI and Telecom Data Breach Rule Guide · IP Camera and CCTV Security Guide