NDAA 889-Compliant CCTV Cameras: A B2B Buyer's Guide

If any part of your project touches federal money — a federal contract, a grant, a cooperative agreement, or a loan program — the surveillance cameras you install are governed by law, not just by budget. Section 889 of the FY2019 National Defense Authorization Act makes certain video surveillance equipment ineligible, and buying the wrong camera can put an entire contract at risk. This guide explains exactly what is prohibited, which camera brands are built to comply, and how to verify a specific model before you commit.

It is written for procurement teams, integrators, and MSPs buying for U.S. government, defense, critical-infrastructure, and federally funded commercial projects. If your project has no federal nexus at all, Section 889 does not legally bind you — but many enterprises now adopt it as a baseline anyway, because it is the clearest available line between trusted and untrusted surveillance hardware.

What Section 889 actually prohibits

Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115-232) contains two separate prohibitions:

• Part A — 889(a)(1)(A), effective August 13, 2019: federal agencies may not procure or obtain covered telecommunications or video surveillance equipment or services, or any system that uses it as a substantial or essential component.
• Part B — 889(a)(1)(B), effective August 13, 2020: federal agencies may not enter into, extend, or renew a contract with any entity that uses covered equipment or services — regardless of whether that use is in performance of the federal contract.

Part B is the one that surprises buyers. It reaches your own internal systems. A contractor can lose eligibility because covered cameras are watching its own parking lot, not because it delivered them to the government. For federal grant, loan, and cooperative-agreement recipients, the same prohibition flows down through 2 CFR §200.216, effective the same August 13, 2020 date.

The implementing contract language is FAR 52.204-25, "Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment." It bars a contractor from providing the Government any equipment, system, or service that uses covered equipment "as a substantial or essential component of any system, or as critical technology as part of any system." The companion clause FAR 52.204-26 is the representation you sign in SAM.gov stating whether you provide or use covered equipment.

Which manufacturers are covered

The statute and the FCC name the same core companies. The distinction between them matters for surveillance buyers:

In practice, physical-security surveillance is exactly the "prohibited purpose" Hikvision, Dahua, and Hytera equipment is called out for, so for security-camera procurement you should treat all three as off-limits alongside Huawei and ZTE.

The rebranding trap

Because the ban follows the manufacturer, not the label on the box, the fastest way to fail an audit is to buy a covered camera wearing someone else's name. Hikvision and Dahua are among the largest OEM camera makers in the world, and their hardware ships under numerous third-party brands. A separate risk lives at the component level: a camera from an otherwise-unlisted brand can still contain a covered system-on-chip (for example a Huawei HiSilicon processor) as a substantial or essential component. Either situation makes the finished camera non-compliant even though the brand name is not on any list. This is why compliance has to be verified per model, not assumed by brand. We covered this failure mode in depth in NDAA Section 889: what's actually banned, the rebranding trap, and what to buy instead.

The FCC Covered List is a separate, overlapping rule

Do not confuse Section 889 (a federal procurement rule) with the FCC Covered List (an equipment authorization rule under the Secure and Trusted Communications Networks Act of 2019). The FCC added Huawei, ZTE, Hytera, Hikvision, and Dahua to the Covered List on March 12, 2021, and most recently updated the list on September 3, 2024. Since February 6, 2023, the FCC has refused new equipment authorizations for covered equipment, which blocks it from being imported to or newly marketed in the United States. The list also now names Kaspersky, China Mobile, China Telecom, China Unicom, and Pacific Networks/ComNet. The authoritative version lives at fcc.gov/supplychain/coveredlist; check it directly rather than trusting a reseller's screenshot.

What to buy instead: compliant camera lines we stock

The brands below are headquartered outside China and market surveillance lines built for Section 889 and FCC-Covered-List environments. "Compliant" still has to be confirmed for the exact model and firmware you order (see the verification checklist), but these are the manufacturers federal and critical-infrastructure buyers reach for first. Everything here is in our Video Surveillance & Security Systems collection.

A word on Uniview. Uniview (Zhejiang Uniview Technologies) is not one of the five companies named in Section 889 or on the FCC Covered List, and it publishes its own NDAA-compliance product list. So it is not federally prohibited today. But it is a China-based manufacturer, which carries regulatory and geopolitical risk that Hikvision and Dahua buyers know well. For strict federal, defense, or critical-infrastructure work, most buyers still choose a non-Chinese brand; for commercial projects with no federal nexus, Uniview can be a value option. We carry it, and we will tell you plainly which category a project falls into — we will not label a Chinese-made camera "889 compliant" to close a sale.

How to verify a camera before you buy

Brand reputation is a starting point, not evidence. For anything that will pass an audit, work this checklist per model:

1. Get a written Section 889 / NDAA compliance statement for the specific model and firmware, on the manufacturer's letterhead — not a generic marketing page.
2. Confirm the chipset origin. Ask for the processor/SoC manufacturer and, where possible, a bill of materials. This catches HiSilicon and other covered silicon inside otherwise-unlisted brands.
3. Check the manufacturer against the FCC Covered List and confirm the device holds a valid FCC equipment authorization (no covered equipment has been authorized since February 6, 2023).
4. Trace the OEM. For unfamiliar or private-label brands, establish who actually manufactures the hardware — the ban follows the maker, not the label.
5. Keep the paper trail. File the compliance letter and your FAR 52.204-26 representation with the project record so you can prove diligence later.

What to send when you request a quote

• Whether the project is federal / federally funded or purely commercial — this determines whether 889 is a hard gate or a preference.
• The use case per location — fixed overview, PTZ, ALPR/LPR, multisensor, thermal, or explosion-protected — so we quote the right compliant line.
• Camera count, resolution, and environment (indoor/outdoor, temperature, hazardous area).
• Your VMS/NVR platform, so we confirm ONVIF or driver compatibility.
• Any written compliance documentation you need to receive with the shipment.

We reply to quote requests within 24 hours, ship worldwide DDP, and accept purchase orders. Tell us the project type and we will quote only models that fit it.

Request a quote on NDAA-compliant surveillance →

Related reading

• NDAA Section 889: what's actually banned, the rebranding trap, and what to buy instead
• How to choose IP security cameras: a buyer's guide
• How to choose an NVR for IP security cameras
• PoE for IP cameras: PoE vs PoE+ vs PoE++ and sizing your power budget