NDAA Section 889 and FCC Covered List Guide: What Contractors Must Represent, Find and Replace

Section 889 of the FY2019 National Defense Authorization Act turns a list of five Chinese telecommunications and video surveillance manufacturers into a condition of doing business with the US federal government, and it reaches equipment a contractor uses anywhere in its own estate, not only what it sells. Buyers searching for an "NDAA compliant camera" or asking whether a "Hikvision ban" applies to them are usually asking about this law, which is implemented in FAR subpart 4.21 and the clauses at FAR 52.204-24, 52.204-25 and 52.204-26, and for grant recipients in 2 CFR 200.216. It sits beside, but is not the same as, the FCC Covered List, which governs subsidies and equipment authorisation. This guide explains Part A and Part B, the representations and the one business day reporting duty, how to find covered gear across cameras, recorders, radios and network kit, and how to plan replacement. It is written for federal contractors and subcontractors, grant recipients, and the security, facilities and procurement teams who answer for them. For the Covered List itself, its legal effects and rip-and-replace funding, see the FCC Covered List and Secure Networks Act Guide; for hardening cameras you keep, see the IP Camera and CCTV Security Guide. Status: clause text as shown on Acquisition.gov (FAC 2026-01) and the FCC Covered List page as read on 8 November 2026.

Key takeaways

• Two prohibitions, two dates. Part A (section 889(a)(1)(A)) has applied since 13 August 2019 and stops agencies buying products that contain covered equipment; Part B (section 889(a)(1)(B)) has applied since 13 August 2020 and stops agencies contracting with any entity that uses covered equipment, whether or not the use relates to a federal contract.
• Five named manufacturers, plus their subsidiaries and affiliates. Huawei and ZTE telecommunications equipment is covered for any use; Hytera, Hikvision and Dahua video surveillance and telecommunications equipment is covered when used for public safety, security of government facilities, physical security surveillance of critical infrastructure and other national security purposes.
• Representation first, then reasonable inquiry. Offerors represent in FAR 52.204-26 (or 52.212-3) whether they provide and whether they use covered equipment; a "does" answer triggers detailed disclosures in 52.204-24. A reasonable inquiry covers information the entity already holds and does not require an audit.
• One business day to report. FAR 52.204-25(d) requires a report within one business day of identifying covered equipment used as a substantial or essential component, and mitigation detail within ten business days. DoD contractors report through DIBNet.
• Badge labels mislead. White-label and OEM cameras and recorders can contain covered manufacturers' hardware or firmware under another brand, so discovery has to look at chipsets, firmware and cloud endpoints, not only the name on the box.

Scope: who and what is covered

Section 889 (Pub. L. 115-232) binds federal executive agencies directly and reaches companies through the contract clauses agencies must use. Grant and loan recipients are reached separately through the Uniform Guidance. The FCC Covered List draws on the same definition: section 889(f)(3) equipment is one of the four determination sources the FCC uses to populate the list, which is why the five manufacturers appear on both.

Covered telecommunications equipment or services

FAR 52.204-25(a) defines the term in four parts. The fourth part is open ended and is the reason a static vendor list is never enough.

The use limitation in paragraph (2) matters for "is my camera banned" questions. A Hikvision camera watching a federal building entrance or a critical infrastructure site is plainly in scope. Because Part B looks at the contractor's own use, many contractors treat any covered camera on their premises as in scope rather than argue about purpose, since lobby and perimeter cameras are physical security surveillance by design.

Who is bound by what

The flowdown point is often misread. Subcontractors receive the clause without (b)(2), so the use prohibition attaches to the entity contracting with the government. A prime still needs to know what its suppliers deliver, because covered equipment inside a delivered system is a Part A problem regardless of tier.

Key obligations

Part A: do not provide

Contractors must not provide equipment, systems or services that use covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology, unless an exception applies or a waiver covers it. In practice this means checking every network, radio, camera, recorder and access control product in a bill of materials before it is offered.

Part B: do not use

Agencies cannot contract with an entity that uses covered equipment as a substantial or essential component of any system, regardless of whether that use is in performance of a federal contract. A covered camera in a branch office, a covered router at a warehouse or a covered radio system used by site security can disqualify the whole entity. This is why the enclave approach (removing covered gear only from contract networks) fails.

Exceptions

• Third-party connections: services that connect to the facilities of a third party, such as backhaul, roaming or interconnection arrangements, are not prohibited. This exempts, for example, traffic that crosses a carrier network you do not control.
• Non-routing equipment: telecommunications equipment that cannot route or redirect user data traffic or permit visibility into user data or packets it transmits or handles.

Neither exception covers a covered camera or recorder you operate, because those capture and handle data rather than pass through someone else's facilities.

Waivers

FAR 4.2104 allowed agency heads to grant one-time waivers to requesting entities, with outer deadlines of 13 August 2021 for Part A and 13 August 2022 for Part B. Those windows have passed. The Director of National Intelligence may still grant a waiver where it serves US national security interests. Contractors should plan on removal, not waiver.

Representations and disclosures

FAR 4.2103 lets a contracting officer rely on a "does not" representation unless there is reason to question it. Both 52.204-24 and 52.204-26 also require a review of SAM exclusions for entities excluded for covered telecommunications equipment or services.

The reporting clock

1. Within one business day of identifying covered equipment or services used as a substantial or essential component or critical technology during contract performance, or of being notified by a subcontractor or other source: contract number, order numbers, supplier name, supplier UEI and CAGE code if known, brand, model number, item description and readily available mitigation information. Report to the contracting officer, or for DoD through https://dibnet.dod.mil; for IDIQ work, to the IDIQ contracting officer and the contracting officer for each affected order.
2. Within ten business days of that report: further mitigation information, the efforts taken to prevent use or submission of covered items, and the steps to prevent future use.

Timeline and current status

As read on 8 November 2026, Acquisition.gov showed the clauses under FAC 2026-01, effective 13 March 2026, with the clause dates above. The FCC Covered List page as fetched still showed an "updated" date of 3 September 2024, but the FCC has since added entries, including foreign-produced drones and drone components on 22 December 2025 and foreign-produced routers on 23 March 2026, so rely on the latest public notices as well as the list page. These later entries sit on the Covered List under the Secure Networks Act; Section 889 itself still names the original five manufacturers. Both can change: the FCC adds entries when a qualifying national security determination is made, and the FAR Council can amend the clauses. Check both pages before each representation cycle, and treat this table as a snapshot.

How Section 889 and the Covered List differ

A product can therefore be legal to own, fail Section 889 for a federal contractor, and be impossible to buy new because its model was never authorised. Kaspersky products are on the Covered List but are not Section 889 covered telecommunications equipment by name; other rules address them.

Enforcement and penalties

• Eligibility: the main consequence is structural. FAR 4.2102 prohibits agencies from entering into, extending or renewing contracts with an entity that uses covered items, so a Part B problem can stop awards and option exercises.
• Contract performance: providing covered items under a contract containing 52.204-25, or missing the one business day report, is a breach of an express contract term handled under the contract and federal procurement law.
• Representations: contracting officers may rely on a "does not" representation; a representation that turns out to be wrong exposes the offeror to the consequences federal procurement law attaches to inaccurate representations. The FAR clauses themselves do not set monetary penalties, and this guide does not estimate them.
• Grants: under 2 CFR 200.216, accepting a grant or loan is itself a certification of compliance, and further certifications come with payment requests and financial reports.

Get legal advice on specific exposure, especially where covered equipment was found after a representation was made.

What it means for AI agents and non-human identities

Section 889 is about hardware and services, yet the work of complying runs through machine identities and automation.

• Device identities are the inventory. Cameras, recorders, radios and switches each carry a device identity, management accounts and often a vendor cloud connection. An accurate register of those identities is the evidence behind a "does not use" representation. See the Device and IoT Identity Guide.
• Service accounts on recorders and video management systems: covered recorders often hold domain-joined service accounts or stored credentials for storage and directory lookups. When you remove the device, revoke and rotate those credentials, or they outlive the hardware.
• Vendor cloud and P2P services: paragraph (3) covers services provided using covered equipment. Device-to-cloud tokens and API keys for a covered manufacturer's remote viewing service should be found and revoked during decommissioning.
• Procurement agents and catalogue bots: if AI agents or purchasing automation raise orders, give them a hard gate that checks manufacturer, OEM and SAM exclusions, logs the check, and routes any camera, radio or network product to a human approver. An agent that buys a white-label recorder can create a Part B issue on its own.
• Discovery automation: scanners and asset tools that fingerprint devices run under privileged service accounts with broad network reach. Scope them tightly and keep their credentials in a vault.

Compliance steps

1. Assign an owner and a register. Name one accountable owner for Section 889 representations, with facilities, IT, security and procurement contributors. Keep a register of every telecommunications, video surveillance, radio and access control asset, with manufacturer, OEM where different, model, firmware and location.
2. Run the reasonable inquiry. Query what you already hold: CMDB and asset tools, network discovery (MAC address vendor prefixes, SNMP system descriptions, ONVIF device information), purchase orders and invoices, facilities contracts and alarm or CCTV maintenance agreements. FAR 4.2101 says this does not require an internal or third-party audit, but it does require you to look at the information you have.
3. Check behind the badge. For cameras and recorders, compare firmware strings, web interface artefacts, default ports and cloud endpoints with known manufacturer platforms. Ask suppliers to state the original equipment manufacturer and chipset vendor in writing for every video and network product.
4. Classify each finding. Decide whether the item is covered, whether an exception applies (third-party backhaul, non-routing equipment), and whether it is used as a substantial or essential component. Record the reasoning.
5. Report where required. If the finding touches contract performance, start the one business day clock and prepare the ten-day mitigation follow-up.
6. Plan replacement. Prioritise by exposure: internet-reachable devices and devices on contract networks first, then physical security cameras at critical sites, then the rest. Budget for recorders, licences and installation, not only cameras. Revoke device credentials and cloud tokens, wipe and dispose of storage media, and update the register.
7. Gate new purchases. Add an 889 and Covered List clause to supplier contracts and catalogue onboarding, require an OEM declaration, and re-check whenever the FCC updates the list or DoD makes a designation.
8. Refresh representations. Re-verify before each annual SAM update and before any offer that includes 52.204-24, and keep the evidence pack with the representation.

Framework mapping

Common failure patterns

• Brand-only checks. Searching the asset register for five names and missing OEM products sold under other labels.
• Facilities blind spot. IT inventories that exclude CCTV, alarm and radio systems managed by facilities or a building landlord's contractor.
• Enclave thinking. Removing covered gear from contract networks while leaving it in offices, missing that Part B looks at the entity's use.
• Stale representations. A SAM representation renewed without re-running the inquiry after acquisitions, new sites or facilities refreshes.
• Removal without credential clean-up. Unplugging a recorder but leaving its service account, stored passwords and vendor cloud tokens active. Disable or rotate every credential tied to the removed device, including any remote support access granted to its supplier.

Practitioner checklist

• Name an accountable owner for Section 889 and keep the evidence pack with each representation.
• Build one register of telecommunications, video, radio and access control assets covering IT, facilities and landlord-managed systems.
• Run network discovery for camera, recorder and network device fingerprints and reconcile with purchase records.
• Require suppliers to declare original equipment manufacturer and chipset vendor for every video and network product.
• Write down the one business day and ten business day reporting steps, including DIBNet access for DoD work.
• Prioritise replacement by exposure and site criticality, and revoke device credentials, service accounts and cloud tokens at removal.
• Gate purchasing systems and procurement agents with a manufacturer, OEM and SAM exclusions check plus human approval.
• Re-check the FCC Covered List and the FAR clause versions before each SAM renewal and major offer.

Standards and references

• Acquisition.gov: FAR 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment
• Acquisition.gov: FAR 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment
• Acquisition.gov: FAR 52.204-26 Covered Telecommunications Equipment or Services Representation
• Acquisition.gov: FAR Subpart 4.21 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment
• eCFR: 2 CFR 200.216 Prohibition on certain telecommunications and video surveillance services or equipment
• FCC: List of Equipment and Services Covered by Section 2 of the Secure Networks Act
• FCC: Fact sheet, Covered List updated to include foreign-produced UAS and UAS critical components (22 December 2025)
• FCC: Public Notice DA 26-278, routers produced in a foreign country added to the Covered List (23 March 2026)
• FCC: Protecting Against National Security Threats to the Communications Supply Chain
• NIST: SP 800-53 Rev. 5

This guide summarises Section 889 of the FY2019 NDAA, its FAR and Uniform Guidance implementation and the FCC Covered List, and is not legal advice. Related NHI Mgmt Group resources: FCC Covered List and Secure Networks Act Guide · IP Camera and CCTV Security Guide · Hardware and Firmware SBOM Guide · OT Product Procurement Guide · Device and IoT Identity Guide