NDAA Section 889: Banned Entities, Covered Equipment, and Waivers

The NDAA Section 889 banned list names five Chinese companies whose equipment federal agencies, contractors, and grant recipients cannot buy or use: Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company. The prohibition covers every subsidiary and affiliate of these firms, and it reaches contractors who use covered equipment anywhere in their operations, not just on the federal contract itself.

The Five Companies and What’s Covered

Section 889 splits the five names into two groups with different scopes.

Huawei and ZTE are restricted broadly. All telecommunications equipment they produce is covered, regardless of how it is used.

Hytera, Hikvision, and Dahua face a purpose-based restriction. Their video surveillance and telecommunications equipment is banned when used for public safety, government facility security, physical security surveillance of critical infrastructure, or other national security purposes.¹ In practice, the “other national security purposes” language pulls in most government-related uses of their products.

The prohibition also captures services provided by these companies or delivered using their equipment. A managed security service running on Hikvision cameras is covered even when the service provider is an unrelated company.²

How the List Can Grow

The five names are not the whole story. The Secretary of Defense, after consulting with the Director of National Intelligence or the Director of the FBI, can add entities to the list. The standard is whether the entity is reasonably believed to be owned by, controlled by, or otherwise connected to the government of a covered foreign country.¹ No new statute is required, so the list is worth monitoring.

Don’t Confuse This With Other Federal Lists

Several federal lists restrict foreign technology, and they do not overlap cleanly. The FCC maintains a separate Covered List under the Secure and Trusted Communications Networks Act of 2019. It includes all five Section 889 companies but also names China Mobile, China Telecom, China Unicom, Pacific Networks Corp, Kaspersky Lab, and certain categories of foreign-made uncrewed aircraft systems.³ The Department of Defense also publishes a list of Chinese Military Companies under Section 1260H of a later NDAA. A company on the FCC list or the 1260H list is not automatically subject to Section 889, and vice versa. Each list carries its own consequences.

What the Ban Actually Prohibits

Section 889 rolled out in two phases the government labels Part A and Part B, and both are now fully in effect.

Part A took effect on August 13, 2019. It bars federal agencies from buying or using any equipment, system, or service that incorporates covered telecommunications equipment as a substantial or essential component, or as critical technology within any system.⁴

Part B took effect on August 13, 2020, and this is where most contractors feel the impact. It prohibits federal agencies from contracting with any entity that uses covered equipment or services anywhere in its operations. The banned hardware does not have to touch the federal contract. A Hikvision camera in a break room at a facility unrelated to government work can trigger a Part B violation.⁴

Both prohibitions flow through FAR clause 52.204-25, which is incorporated into every federal contract.¹

What Counts as Covered Equipment

Two defined terms decide whether a piece of hardware triggers the ban.

A “substantial or essential component” is any component necessary for the proper function or performance of a piece of equipment, system, or service. The definition is intentionally broad. A Huawei chipset inside a third-party router qualifies, because the router will not function without it.

“Critical technology” reaches further, sweeping in items on the U.S. Munitions List, the Commerce Control List, nuclear-related equipment, select biological agents, and emerging technologies controlled under the Export Control Reform Act.¹

Exceptions

Two categories of equipment and services do not trigger the ban even if a named company’s infrastructure sits somewhere in the chain.

Third-party connection services. Backhaul, roaming, and interconnection arrangements are exempt. If a contractor’s cellular service routes through ZTE equipment on a foreign carrier’s network during international roaming, that does not create a violation.²
Non-routing equipment. Telecommunications equipment that cannot route or redirect user data traffic and cannot provide visibility into any user data or packets is exempt. A passive cable or a power supply made by a named company falls here, though most contractors avoid even this gray zone.

These carve-outs exist because a blanket prohibition on any contact with named-company infrastructure would make global telecommunications almost impossible. Carriers interconnect constantly across borders.

Grant and Loan Recipients Are Covered Too

Section 889 does not stop at procurement contracts. The statute separately prohibits federal agencies from spending loan or grant funds to buy, extend, or renew contracts for covered equipment or services.² The obligation flows down through 2 CFR 200.216, which bars recipients and subrecipients from using federal financial assistance to procure covered equipment.⁵

This catches organizations that would not describe themselves as government contractors. A university spending a federal research grant, a rural hospital funded through USDA programs, and a local fire department that bought cameras with a FEMA grant all fall under the same rule. Agencies administering these programs are directed to prioritize funding and technical support for the transition to compliant equipment, but the replacement obligation ultimately falls on the recipient.²

Finding Banned Parts in White-Label Gear

Nobody accidentally buys a box with “Huawei” printed on it. The real problem is white-label and OEM products where banned hardware is rebranded or embedded inside third-party equipment. Many security cameras sold under lesser-known names use Hikvision or Dahua sensors, boards, or firmware inside. A camera from a brand you have never heard of may still be covered equipment.

Practical identification methods:

Review supplier expenditure records over a 12-to-24-month window to flag purchases from distributors or resellers tied to named entities.
Check shipping records for OEM relationships that are not visible on product packaging.
For networked equipment like IP cameras, use MAC address and OUI lookup tools to identify the actual manufacturer.
When those methods are inconclusive, physically open a device and check interior labeling.

Cloud services and software-as-a-service products complicate this further. Part B covers any equipment a contractor “uses,” and if a cloud provider’s data center runs on banned networking hardware, that could theoretically create a compliance issue. The government has not issued detailed guidance on how deep an inquiry into a cloud provider’s stack must go, but the reasonable-inquiry obligation still applies.

Your Disclosure and Reporting Obligations

Three FAR provisions enforce Section 889, and each does a different job.

Representations Before Award

FAR 52.204-26 is the simplest. Every offeror checks a box representing whether it provides covered equipment to the government and whether it uses covered equipment anywhere in its operations. Before completing the representation, the offeror must check the System for Award Management for entities excluded for covered telecommunications issues.⁶

FAR 52.204-24 goes deeper. If an offeror cannot represent that it is free of covered equipment, it must disclose specifics: what the equipment is, who manufactured it, where it is used, and whether it will be used in performing the contract.⁷ These representations are made under penalty of law. A false certification can trigger liability under the False Claims Act or criminal fraud statutes.

The Reasonable Inquiry Standard

Both the representation and the ongoing contract obligation require a “reasonable inquiry.” The FAR defines this as an inquiry designed to uncover any information in the entity’s possession about the identity of the producer or provider of covered equipment, and it explicitly states that a reasonable inquiry does not require an internal or third-party audit.¹ No audit is not the same as no effort. A contractor that checks the box without reviewing procurement records, IT inventories, and supplier relationships is taking a real risk. The standard calls for a good-faith effort proportional to the size and complexity of the organization.

Reporting During Contract Performance

If a contractor discovers covered equipment during a contract, FAR 52.204-25 sets a two-stage reporting deadline. Within one business day of discovery, the contractor must report the contract number, supplier name, brand, model number, item description, and any immediately available information on mitigation steps. Within ten business days after that initial report, the contractor must submit additional mitigation details and describe what it did to prevent the use of covered equipment and what it will do to prevent recurrence.¹

Failing to report is treated more seriously than the initial discovery. Noncompliance can result in contract termination, suspension, or debarment from future federal contracting.

The Waiver Path Is Narrow

The law provides limited relief. An agency head may grant a waiver on a case-by-case basis for up to two years if the requesting entity shows a compelling justification for additional time and demonstrates that the waiver serves the national security interest of the United States. The Director of National Intelligence may separately grant a waiver on national security grounds.⁸

A waiver request must include a detailed phase-out plan showing how banned equipment will be removed within the waiver period. Waivers are not easy to obtain. Agencies view them as a bridge to compliance rather than a permanent accommodation. Contractors who find banned equipment deep in their infrastructure should generally focus on replacement timelines rather than waiver applications, unless the operational impact of immediate removal would be genuinely severe.

1
Acquisition.GOV. 48 CFR 52.204-25 – Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment
2
GovInfo. Public Law 115-232 – John S. McCain National Defense Authorization Act for Fiscal Year 2019
3
Federal Communications Commission. List of Equipment and Services Covered By Section 2 of The Secure Networks Act
4
Acquisition.GOV. Section 889 Policies
5
eCFR. 2 CFR 200.216 – Prohibition on Certain Telecommunications and Video Surveillance Equipment or Services
6
Acquisition.GOV. 52.204-26 Covered Telecommunications Equipment or Services – Representation
7
Acquisition.GOV. 48 CFR 52.204-24 – Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment
8
Federal Register. Federal Acquisition Regulation: Prohibition on Contracting With Entities Using Certain Telecommunications and Video Surveillance Services or Equipment