NDAA Compliance for Commercial Security Systems

“NDAA compliant” is commonly used in the commercial security industry, but the phrase involves more than selecting a camera with a compliance badge on a product sheet.

Request a Commercial Security Assessment

Section 889, Covered Equipment, Supply-Chain Review and Security-System Procurement

For federal contractors and other organizations with procurement or supply-chain requirements, NDAA-related security planning can involve equipment manufacturers, subsidiaries and affiliates, OEM relationships, video surveillance services, existing installed equipment, subcontractors, documentation and the organization’s broader use of covered technology.

Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 established federal restrictions involving certain telecommunications and video-surveillance equipment and services. Those requirements are implemented through FAR Subpart 4.21 and related provisions and clauses including FAR 52.204-24, 52.204-25 and 52.204-26.

For broader guidance involving codes, standards, procurement requirements and inspection-sensitive security projects, visit Regulatory Compliance & Inspection Readiness.

Important: This resource provides general commercial-security planning information. Contract terms, current federal regulations, agency requirements and advice from appropriately qualified legal or contracting professionals should control when a formal compliance determination is required.

What NDAA Compliance Means for Commercial Security

In physical security, “NDAA compliant” is often used as shorthand for avoiding equipment or services covered by Section 889.

The actual federal framework is more specific than a general prohibition on products manufactured in China.

FAR Subpart 4.21 identifies covered telecommunications equipment and services that include telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation, including subsidiaries or affiliates.

For specified public-safety, government-facility, critical-infrastructure-surveillance and national-security purposes, the definition also includes video-surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company and Dahua Technology Company, including subsidiaries and affiliates.

The framework also addresses telecommunications or video-surveillance services provided by covered entities or using covered equipment, as well as certain additional entities identified through federal national-security determinations.

That is why a meaningful compliance review should go beyond the logo printed on a camera.

Section 889 Part A and Part B

Section 889 contains two restrictions that commercial security buyers and federal contractors should understand.

Section 889 Part A

Part A addresses what the federal government may procure.

The prohibition generally prevents executive agencies from procuring, obtaining, extending or renewing contracts to procure or obtain equipment, systems or services that use covered telecommunications equipment or services as a substantial or essential component or as critical technology, subject to applicable exceptions or waivers.

For a security-system project, this can directly affect equipment selected for a federal procurement.

Section 889 Part B

Part B can be broader from the contractor’s perspective.

It generally prohibits an executive agency from entering into, extending or renewing a contract with an entity that uses covered telecommunications equipment or services as a substantial or essential component of a system or as critical technology, subject to applicable exceptions or waivers.

Importantly, the FAR states that this prohibition applies regardless of whether the covered use occurs in performance of the federal contract itself.

That means a contractor evaluating Section 889 exposure may need to consider more than the equipment proposed for a new government project.

Existing systems elsewhere in the organization’s environment can matter.

NDAA Compliance Is Not Simply a Camera-Brand Checklist

Cameras receive much of the attention because video surveillance is one of the most visible areas affected by Section 889.

A serious review should look beyond the camera model.

Depending on the system, relevant components may include:

Cameras
Network video recorders
Video-management appliances
Servers
Storage equipment
Gateways
Analytics hardware
Video intercom endpoints
Communications devices
Remote-management services
Hosted video services
Existing legacy equipment
OEM or private-label products

The question is not merely, “What brand is written on the box?”

A stronger question is:

Who produced the equipment or service, what entities are behind it, and how does it function within the completed system?

For complete system-design considerations involving cameras, recording and surveillance architecture, visit Commercial & Industrial Video Surveillance Systems.

Manufacturer, OEM and White-Label Risk

Commercial security equipment is frequently sold through OEM, private-label and rebranded arrangements.

A camera or recorder may carry one brand while the underlying equipment was produced by another company.

That creates an obvious weakness in a compliance process based solely on the front-facing label.

The FCC has specifically addressed white-labeled or rebranded covered equipment and has made clear that changing the label does not change the covered status of the underlying equipment.

A procurement review may therefore need to identify:

Original manufacturer
Parent company
Subsidiaries or affiliates
OEM relationships
Private-label relationships
Distributor information
Product family
Model number
Supporting services
Cloud or remote-management dependencies

For organizations with formal requirements, equipment lineage should be documented rather than assumed.

The FCC Covered List Is a Current Reference, Not a Static Historical List

The FCC Covered List is another important federal resource for organizations evaluating communications and surveillance equipment.

It should not be treated as a list that was created once and never changed.

The list and related federal equipment-authorization actions have continued to evolve.

That matters because an equipment decision based on an old manufacturer list, old sales presentation or several-year-old distributor statement may not reflect the current federal position.

Organizations with procurement-sensitive projects should check current official references when equipment is specified and again when substitutions or significant system changes are proposed.

A product that was acceptable under an organization’s earlier purchasing policy should not automatically be assumed to satisfy a later project requirement.

“NDAA Compliant” Does Not Mean “Cybersecure”

NDAA compliance and cybersecurity are related to supply-chain risk, but they are not the same thing.

Avoiding covered equipment does not eliminate the need for:

Strong administrator credentials
Appropriate password management
Network segmentation
Secure remote access
Firmware management
Software updates
Role-based permissions
Logging
Account ownership
Controlled cloud access
Backup and recovery planning
Responsible system administration

A product can avoid a Section 889 problem and still be poorly configured.

Likewise, a secure configuration does not make covered equipment acceptable where Section 889 restrictions apply.

Security-system procurement and cybersecurity should be treated as separate but complementary responsibilities.

For broader manufacturer, platform, architecture and long-term ownership planning, visit Security Technologies & Platforms.

Reasonable Inquiry

The FAR uses the term reasonable inquiry when addressing representations concerning covered telecommunications equipment and services.

The definition focuses on an inquiry designed to uncover information already in the entity’s possession about the identity of the producer or provider of covered equipment or services.

It does not require an internal or third-party audit simply to satisfy the definition of reasonable inquiry.

That does not mean organizations should avoid asking obvious questions.

Depending on the circumstances, useful records may include:

Equipment inventories
Bills of materials
Purchase records
Proposals
Manufacturer documentation
Distributor records
Existing-system documentation
Service agreements
Monitoring agreements
Cloud-service records
Asset databases
As-built documentation
Previous installation records

The quality of the conclusion depends heavily on the quality of the information reviewed.

Existing Security Systems Can Create Compliance Questions

New construction is usually easier to evaluate because the equipment can be selected before installation.

Existing buildings are more complicated.

A facility may already contain:

Older surveillance cameras
Relabeled cameras
Legacy NVRs
Existing VMS servers
Video intercoms
Remote-access services
Older communications devices
Equipment installed by a previous contractor
Customer-furnished equipment
Systems inherited through an acquisition
Security equipment at remote branch locations

A current proposal may involve replacing only a recorder or adding several cameras while leaving most of the existing environment unchanged.

For an organization with Section 889 obligations, that inherited environment may deserve review before the project scope is finalized.

The objective should be to understand what is already installed, what is staying and whether retained equipment creates a procurement or contracting concern.

Security-System Takeovers and Service Contracts

System takeovers deserve particular attention.

A new integrator may be asked to assume responsibility for monitoring, maintenance, software administration or selective upgrades without originally supplying the equipment.

Before accepting a compliance-sensitive takeover, the existing environment should be documented sufficiently to understand what the service relationship will cover.

A review may include:

Cameras
Recorders
Servers
Intercoms
Communications modules
Remote services
Cloud platforms
Existing manufacturer relationships
Customer-owned equipment
Equipment proposed to remain
Equipment proposed for replacement

If a questionable platform is discovered, a phased migration may be more practical than pretending the issue does not exist.

Video Surveillance Services Matter Too

Section 889 is not limited to physical equipment.

The federal definitions also address telecommunications and video-surveillance services.

That means a compliance review may need to consider services operating behind or alongside the installed equipment.

Depending on the project, examples may include:

Hosted video services
Remote video services
Cloud connectivity
Managed surveillance layers
Communications services
Remote administration
Third-party support dependencies

The hardware on the wall is only one part of the system.

The service chain behind that hardware can matter as well.

Access Control and Integrated Security Systems

Access control is not usually the first technology buyers associate with NDAA restrictions, but modern physical-security environments are frequently integrated.

Access control may share:

Video intercoms
Servers
Network infrastructure
Cloud platforms
Remote administration
Gate systems
Camera integrations
Unified management platforms

A compliance-sensitive project should therefore consider how different systems connect rather than evaluating every technology as though it exists independently.

For commercial controlled-opening, credential and access-management planning, visit Commercial & Industrial Access Control Systems.

Subcontractors and Supplier Relationships

Federal contracting requirements do not necessarily stop with the prime contractor.

FAR 52.204-25 includes a subcontract flow-down requirement for the substance of the clause in applicable subcontracts and other contractual instruments, including commercial products and commercial services.

That makes supplier and subcontractor communication important.

A project team may need to understand:

Who is supplying equipment
Whether substitutions are permitted
Who produced substituted equipment
Whether an OEM relationship exists
Whether subcontractors are providing security-related services
Whether customer-furnished equipment is part of the finished system
What documentation must be provided at closeout

Compliance requirements should be communicated before procurement whenever possible.

Discovering an unacceptable substitution after equipment is installed is far more disruptive than identifying the issue during submittal review.

NDAA Compliance in Specifications and Submittals

A specification that says only “NDAA compliant” may leave too much room for interpretation.

When the project has a genuine Section 889 requirement, procurement documents can be stronger when they identify the applicable standard and require sufficient manufacturer and product information to support review.

Depending on the project, documentation may include:

Manufacturer
Model number
Product family
Equipment schedule
Original equipment manufacturer where relevant
Distributor
Applicable compliance documentation
Cloud or hosted services
Proposed substitutions
Existing equipment being retained
Customer-furnished equipment

Substitutions should receive the same scrutiny as the originally specified product.

Compliance should survive the purchasing process—not disappear when a different model becomes available.

Common NDAA Compliance Mistakes

Checking Only the Camera Manufacturer

Recorders, services, relabeled products and existing equipment may also require review.

Treating NDAA as a Country-of-Origin Rule

Section 889 is a covered-equipment and covered-entity framework. A simple “made here” or “made there” test does not replace review of the applicable federal requirements.

Relying on the Product Label

Private-label and OEM relationships can make the visible brand an incomplete indicator of product lineage.

Using an Outdated Equipment List

Federal references can change. Current official sources should be reviewed for projects where compliance matters.

Assuming a Private Facility Cannot Matter

Part B can create concerns involving an entity’s use of covered equipment even when that equipment is not being supplied directly under the federal contract.

Ignoring Existing Equipment

A new compliant camera does not automatically solve an inherited environment containing questionable legacy equipment.

Treating an Exception as a Blanket Approval

FAR exceptions are specific. Their applicability should be evaluated against the actual equipment, service and contract circumstances.

Failing to Document the Review

A conclusion is more defensible when the organization can identify the equipment, records and representations it relied upon.

A Practical NDAA Security-System Review

A disciplined review can follow a simple sequence.

1. Identify the Requirement

Determine why NDAA compliance matters to the project.

Is the organization a federal contractor? Is there a contractual requirement? Is the restriction coming from an owner standard, procurement specification, critical-infrastructure program or enterprise security policy?

2. Inventory the Relevant Environment

Document the equipment and services that may be affected.

Do not look only at the new proposal if existing systems will remain.

3. Identify Producers and Providers

Determine who actually manufactures or provides the relevant equipment and services.

Investigate questionable private-label or OEM relationships instead of relying solely on marketing names.

4. Review Current Official Sources

Use current FAR, Acquisition.gov and FCC references rather than an old distributor list or sales document.

5. Document the Inquiry

Record what equipment was reviewed, what documentation was examined and how questionable items were resolved.

6. Address Legacy Exposure

If covered or unacceptable equipment is identified, determine whether it should be replaced immediately or handled through an organized migration plan consistent with the organization’s requirements.

7. Protect the Standard During Procurement

Review substitutions, customer-furnished equipment and field changes so the completed installation remains consistent with the project requirement.

Reporting Requirements for Federal Contractors

FAR 52.204-25 contains reporting requirements when covered telecommunications equipment or services are identified during contract performance under circumstances addressed by the clause.

The current clause requires specified initial information to be reported within one business day of identification or notification and additional information regarding mitigation and prevention efforts within 10 business days.

Organizations subject to these requirements should follow the applicable contract language and current federal procedures.

A discovery in the field should therefore not be treated as merely an installer problem.

Estimating, procurement, project management, service and organizational leadership may all need defined escalation procedures when compliance-sensitive equipment is identified.

Official Federal References

Organizations making formal Section 889 decisions should review current government sources directly:

Because federal requirements and covered-list determinations can change, current official sources should take precedence over older summaries, product brochures or informal compliance lists.

Frequently Asked Questions About NDAA Compliance and Commercial Security

What does NDAA compliant mean for a security camera system?

In general commercial-security usage, it means the equipment and services have been evaluated against applicable Section 889 restrictions concerning covered telecommunications and video-surveillance equipment or services.

Does NDAA ban every security camera manufactured in China?

No. Section 889 is not written as a blanket country-of-origin prohibition covering every Chinese-manufactured camera. The FAR defines specific covered equipment, services, entities and circumstances.

Which manufacturers are specifically named in the FAR?

The FAR identifies Huawei and ZTE for covered telecommunications equipment and identifies Hytera, Hikvision and Dahua for specified video-surveillance and telecommunications purposes, including subsidiaries and affiliates.

Does Section 889 apply only to cameras?

No. Depending on the equipment and circumstances, telecommunications equipment, video-surveillance equipment and related services can be relevant.

Does a different brand label make covered equipment acceptable?

Not necessarily. OEM, private-label and rebranding relationships should be investigated. The FCC has stated that white-labeling does not change whether underlying covered equipment is covered.

Can existing security equipment create an NDAA problem?

Potentially. Existing cameras, recorders, services and other installed equipment may need review when an organization has Section 889 obligations.

Is NDAA compliance the same as cybersecurity?

No. NDAA compliance addresses specific federal procurement and supply-chain restrictions. Cybersecurity also requires secure configuration, network design, credential management, updates and other controls.

What is a reasonable inquiry?

The FAR defines reasonable inquiry as an inquiry designed to uncover information in the entity’s possession concerning the identity of producers or providers of covered telecommunications equipment or services, without requiring an internal or third-party audit.

Can an NDAA-sensitive project use existing infrastructure?

Potentially. Cabling, network equipment, power infrastructure and other components can be evaluated individually. Whether a particular component can remain depends on the applicable requirements and the role it performs.

Who should make the final NDAA compliance determination?

Formal compliance decisions should be based on current contract requirements, federal regulations and appropriate procurement, contracting or legal guidance. A security integrator can assist with equipment identification, system inventory, manufacturer documentation and migration planning.

Request an NDAA-Focused Security Assessment

Northeast Remote Surveillance and Alarm, LLC can help commercial and industrial organizations evaluate security-system equipment, inherited infrastructure, manufacturer information, integration dependencies and modernization requirements when procurement defensibility or equipment lineage matters.

An assessment can help identify what is installed, what is proposed, what documentation is available and where additional manufacturer or contracting review may be required.

Request a Commercial Security Assessment.

Northeast Remote Surveillance and Alarm, LLC
Commercial & Industrial Security Systems