What Is NDAA Compliance? Section 889, Covered Companies, and Penalties

NDAA compliance means following the security provisions Congress writes into the National Defense Authorization Act each year — most importantly Section 889 of the FY2019 NDAA, which bars federal agencies, their contractors and subcontractors, and federal grant recipients from buying or using certain Chinese-made telecommunications and video surveillance equipment. The rules reach well past the Pentagon. If your organization holds a federal contract, works under one as a subcontractor, or accepts federal grant money, you are responsible for keeping banned equipment out of your operations and for certifying that honestly. Failing at either can cost you the contract, get you debarred, or expose you to False Claims Act liability.

What Section 889 Prohibits

Section 889 rolled out in two phases, and the second phase is the one that trips companies up.¹

Part A: Direct Procurement

Effective August 13, 2019, Part A bars federal agencies from directly buying any equipment, system, or service that uses covered telecommunications equipment as a substantial or essential component, or as critical technology within any system.² It applies to all purchases, including commercial items and micro-purchases. There is no dollar threshold that lets a small buy slip through.

Part B: Enterprise-Wide Use

Effective August 13, 2020, Part B extended the prohibition to any entity that uses covered equipment anywhere in its operations, regardless of whether that use has anything to do with the federal contract.² This is where the ban has real teeth. If Hikvision cameras monitor a warehouse that has nothing to do with government work, you still cannot hold a federal contract. The prohibition covers the whole enterprise.

Which Companies and Products Are Covered

Section 889 originally named five Chinese companies. The scope has grown. The FCC maintains a Covered List under Section 2 of the Secure Networks Act, updated as recently as March 2026, that now includes:³

Huawei Technologies Company: all telecommunications equipment, including services provided by or using Huawei equipment.
ZTE Corporation: all telecommunications equipment and related services.
Hytera Communications Corporation: video surveillance and telecommunications equipment used for public safety, government facility security, critical infrastructure surveillance, or national security purposes.
Hangzhou Hikvision Digital Technology Company: video surveillance and telecommunications equipment under the same national security scope as Hytera.
Dahua Technology Company: video surveillance and telecommunications equipment under the same national security scope.
AO Kaspersky Lab and Kaspersky Lab, Inc.: information security products, cybersecurity and anti-virus software, including equipment with integrated Kaspersky software.
China Mobile International USA, China Telecom (Americas), Pacific Networks Corp/ComNet (USA), and China Unicom (Americas): international telecommunications services.
Certain uncrewed aircraft systems: drones and critical UAS components produced in covered foreign countries, subject to specific exemptions.

The definition of covered telecommunications equipment or services also picks up any entity the Secretary of Defense, in consultation with the Director of National Intelligence or the FBI Director, reasonably believes is owned or controlled by the government of a covered foreign country.² The category is open-ended, so the list can effectively expand without new legislation.

Kaspersky Lab was separately banned from federal systems under Section 1634 of the FY2018 NDAA, which prohibited government use of any Kaspersky covered article on or after October 1, 2018.⁴

Who Has to Comply

Federal Contractors and Subcontractors

Any company holding a federal contract, or hoping to win one, must certify that it does not provide or use covered equipment. Under FAR 52.204-25, prime contractors must flow the requirement down to every tier of subcontractor, including subcontracts for commercial products and services.⁵ The clause applies to the substance of the prohibition, so subcontractors cannot claim ignorance because the requirement was missing from their paperwork.

Federal Grant Recipients

Organizations receiving federal grants or loans cannot use those funds to buy, extend, or renew contracts for covered telecommunications equipment or services under 2 CFR 200.216.⁶ Accepting a federal grant is a certification of compliance. Universities, state agencies, nonprofits, and local governments all fall under this rule when they take federal money.

Defense Contractors Over $5 Million

Section 847 of the FY2020 NDAA adds a separate layer for defense contractors and subcontractors on contracts worth more than $5 million. They must disclose beneficial ownership information and submit to assessments of foreign ownership, control, or influence. The Defense Counterintelligence and Security Agency reviews and adjudicates the disclosures.⁷ Commercial contracts are generally exempt unless a DOD official determines the contract involves national security risk or sensitive data.

The Certification and Reasonable Inquiry Requirement

Before winning a federal contract, you complete a formal representation about covered equipment. FAR 52.204-24 requires offerors to state whether they will provide covered equipment to the government and, after conducting a “reasonable inquiry,” whether they currently use covered equipment anywhere in their operations.⁸

“Reasonable inquiry” sounds vague, and that is by design. GSA guidance says the inquiry must uncover any information in your possession about the identity of producers or providers of covered equipment you use, but it specifically does not require a formal internal or third-party audit.⁹ The inquiry must still cover all equipment, systems, and services your company uses, regardless of location, including equipment owned or provided by affiliates, subsidiaries, and suppliers. Not needing a formal audit does not make a cursory check sufficient. Certify compliance without genuinely investigating and turn out to be wrong, and you have serious legal exposure.

The White-Label Problem

One of the harder pieces of the inquiry is equipment sold under a different brand name. Hikvision and Dahua in particular have manufactured cameras and video surveillance hardware sold under dozens of other brands through OEM and white-label agreements. A camera may carry a name you have never associated with China and still contain Hikvision firmware and Dahua chipsets inside.

No single government tool detects this. Compliance teams check MAC address prefixes (the first six characters of a device’s hardware address, which identify the manufacturer), examine firmware version strings, and review the Organizationally Unique Identifier registrations maintained by the IEEE. Some banned manufacturers’ hardware identifiers persist even when the device is rebranded. If your organization relies on video surveillance and you want federal contracts, auditing your camera inventory at the component level is the only way to make the representation honestly.

Waivers and Narrow Exceptions

The NDAA gave agency heads authority to grant one-time waivers from the Part B prohibition, but only for up to two years after the August 13, 2020 effective date. The statutory waiver window closed on August 13, 2022, and no subsequent legislation has reopened it.¹⁰ For practical purposes, waivers are no longer an option. You comply or you forgo federal contracts and grants.

One narrow exception survives. Section 889 does not prohibit a federal agency from contracting with an entity that provides a service connecting to a third party’s facilities through backhaul, roaming, or interconnection arrangements.¹¹ If a cell phone roams onto a network that happens to use Huawei equipment in its backbone, that alone does not disqualify a federal buyer. The exception applies only to the agency contracting for the service. It does not extend to a contractor’s own use of a service connecting to banned infrastructure.

CMMC for Defense Contractors

NDAA compliance for defense contractors also now includes the Cybersecurity Maturity Model Certification program, which sets cybersecurity standards for contractors handling federal contract information or controlled unclassified information. Phase 1 of CMMC 2.0 implementation began on November 10, 2025, and runs through November 9, 2026, focusing on Level 1 and Level 2 self-assessments.¹²

Level 1 protects federal contract information through annual self-assessment against 15 security requirements with annual affirmation. No plans of action are permitted; you meet all 15 or you do not pass.
Level 2 protects controlled unclassified information through annual self-assessment or an independent assessment by a CMMC Third-Party Assessment Organization every three years, depending on the solicitation. It requires compliance with 110 NIST SP 800-171 Revision 2 requirements, with results entered into the Supplier Performance Risk System. Plans of action are allowed but must close within 180 days.¹³
Level 3 adds 24 requirements from NIST SP 800-172 on top of Level 2 and is assessed every three years by the Defense Contract Management Agency’s DIBCAC.¹³

CMMC requirements will phase into DOD solicitations over three years. The level you need depends on the sensitivity of information you handle.

What Noncompliance Costs

Contract Termination and Debarment

An agency can terminate a contract for cause when a contractor is found using banned equipment. Beyond that single contract, a company can be suspended or debarred, meaning it is excluded from receiving any federal contracts for up to three years and agencies cannot consent to its participation as a subcontractor during that period.¹⁴ Debarred entities are listed publicly in SAM.gov.

False Claims Act Liability

This is where exposure escalates. Every time a contractor certifies compliance with Section 889, whether through the FAR 52.204-24 representation, annual SAM.gov certifications, or payment requests, that certification can become the basis for a False Claims Act case if it turns out to be inaccurate. A contractor that knowingly submits a false claim is liable for three times the government’s damages plus per-claim civil penalties.¹⁵ The “knowing” standard includes deliberate ignorance and reckless disregard, so a contractor who never conducted a genuine reasonable inquiry cannot claim it did not know about banned equipment in its supply chain.

Building an Ongoing Compliance Process

Compliance is not a one-time event. The scope of banned equipment can expand, and your own supply chain changes.

Start with a thorough inventory of every telecommunications device, video surveillance camera, networking component, and cybersecurity software product your organization uses, across all locations, not just those tied to government work. Check each device against the FCC’s Covered List and the entities named in Section 889. For video surveillance, investigate at the component level to catch white-labeled or OEM products from banned manufacturers.

Document the inquiry. A formal audit is not required for the FAR representation, but the distinction between “reasonable inquiry” and “formal audit” will not protect you if your process was superficial. If you ever have to defend a certification in a False Claims Act investigation, you will need to show what you checked and when.

If your organization is a defense contractor, prepare for CMMC certification now. Self-assessment requirements for Levels 1 and 2 are active during 2026, and waiting until a solicitation demands certification means you are already behind. Build a phase-out plan for any covered equipment you find, and budget for replacement. The government will not subsidize the transition.

1
U.S. Election Assistance Commission. What Is Section 889 of The FY 2019 NDAA
2
Acquisition.GOV. Section 889 Policies
3
Federal Communications Commission. List of Equipment and Services Covered By Section 2 of The Secure Networks Act
4
Acquisition.GOV. 52.204-23 Prohibition on Contracting for Hardware, Software, and Services Developed or Provided by Kaspersky Lab and Other Covered Entities
5
Acquisition.GOV. 52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment
6
eCFR. 2 CFR 200.216 Prohibition on Certain Telecommunications and Video Surveillance Equipment or Services
7
Defense Counterintelligence and Security Agency. National Defense Authorization Act, Section 847
8
Acquisition.GOV. 52.204-24 Representation Regarding Certain Telecommunications and Video Surveillance Services or Equipment
9
GSA. GSA Implementation of Section 889 Frequently Asked Questions 3.0
10
Department of Defense. Implementation of Waiver Procedures for the Section 889(a)(1)(B) Prohibitions
11
Federal Register. Federal Acquisition Regulation: Prohibition on Contracting With Entities Using Certain Telecommunications and Video Surveillance Services or Equipment
12
Department of Defense CIO. Cybersecurity Maturity Model Certification
13
Department of Defense CIO. About CMMC
14
Acquisition.GOV. Subpart 9.4 – Debarment, Suspension, and Ineligibility
15
Office of the Law Revision Counsel. United States Code Title 31 – 3729