Section 889 Compliance Explained: What Federal IT Buyers Must Know in 2026 Leave a comment

If you hold a federal contract — or plan to bid on one — Section 889 of the National Defense Authorization Act (NDAA) is one of the most consequential compliance requirements you’ll face. It’s not simply about what IT equipment you deliver to a government agency. It’s about what’s running in your own office, on your own network, and throughout your entire supply chain. Many contractors have been blindsided by the so-called “Part B” provisions and have faced contract termination and False Claims Act exposure as a result. This guide breaks down everything federal IT buyers, program managers, and procurement officers need to know about Section 889 compliance in 2026.

What Is Section 889 of the NDAA?

Section 889 is part of the National Defense Authorization Act for Fiscal Year 2019, signed into law on August 13, 2018. It was designed to protect federal networks and national security by prohibiting the use of telecommunications and video surveillance equipment manufactured or provided by a specific group of Chinese technology companies.

The law operates in two distinct parts, each with its own effective date and scope:

Part A — What Federal Agencies Cannot Buy (Effective August 13, 2019)

Part A prohibits federal agencies from directly procuring covered telecommunications equipment or services. If a contracting agency wants to buy network hardware, security cameras, communication devices, or related services, it cannot purchase products from the five named companies or their subsidiaries. This part is primarily aimed at the supply side — what goes into government facilities and systems as a result of government purchasing decisions.

Part B — What Contractors Cannot Use (Effective August 13, 2020)

Part B is where many contractors get caught off guard. It prohibits federal contractors from using covered telecommunications equipment or services as a substantial or essential component of any system — even in their own internal operations. This means that if your company has a Hikvision camera system in your lobby, Huawei routers in your server room, or ZTE phones used by your staff, you are potentially in violation of Part B of Section 889 — regardless of whether that equipment has anything to do with the work you’re performing under the federal contract.

These requirements are codified in the Federal Acquisition Regulation (FAR) under clauses 52.204-24, 52.204-25, and 52.204-26. Any company performing work under a federal contract will find these clauses included in their contract documents.

What Equipment and Companies Are Specifically Banned?

Section 889 identifies five companies — and their subsidiaries and affiliates — as sources of “covered” telecommunications and video surveillance equipment. Understanding what each company produces helps contractors conduct meaningful audits of their infrastructure and procurement pipelines.

Huawei Technologies

Huawei is one of the world’s largest telecommunications equipment manufacturers. Covered products include enterprise networking equipment (routers, switches, access points), servers, mobile handsets, and — critically — semiconductor chips manufactured by Huawei’s chip subsidiary HiSilicon. The HiSilicon issue is particularly important because HiSilicon chips are embedded in products from other brands, which can make those products covered even if Huawei’s name isn’t on the box.

ZTE Corporation

ZTE manufactures networking hardware, mobile phones, and telecom infrastructure equipment. Any ZTE-branded router, switch, mobile device, or telecom system used by a contractor falls under the prohibition.

Hytera Communications

Hytera specializes in professional mobile radio communications, including two-way radios, body cameras, and push-to-talk devices. Security personnel, field teams, and facilities staff using Hytera radios need to be aware that this equipment is specifically covered under Section 889.

Hangzhou Hikvision Digital Technology

Hikvision is one of the world’s largest manufacturers of video surveillance equipment. Covered products include IP cameras, digital video recorders (DVRs), network video recorders (NVRs), and complete video surveillance systems. Hikvision products are extremely widespread in commercial real estate, warehouses, and office environments — meaning many contractors may have them installed without realizing it.

Dahua Technology

Like Hikvision, Dahua is a major surveillance equipment manufacturer. Covered products include IP cameras, DVRs, access control systems, and integrated video surveillance platforms. Dahua products are sometimes sold under other brand names or through white-label arrangements, which makes supply chain diligence especially important.

An important nuance: The ban extends to “substantial or essential components” and “critical technology.” This means that even a product from a completely different brand may be covered if a subsidiary of one of these five companies manufactured a core component — particularly chips or critical subsystems. When in doubt, always consult your contracting officer or legal counsel.

The Part B Trap — Your Own Infrastructure Is Under Scrutiny

The single biggest compliance mistake contractors make is focusing exclusively on what they deliver to the government and ignoring their own internal infrastructure. Part B of Section 889 is unambiguous: if you use covered equipment in your operations while performing work under a federal contract, you are in violation — even if that equipment never touches a government system.

Consider a scenario that plays out more often than you might think. A small defense subcontractor retrofits its office with a modern IP camera system to improve physical security — a reasonable business decision. But the cameras are Hikvision models, purchased at a competitive price from a local reseller. Two years later, the company wins a federal contract and signs a solicitation containing FAR 52.204-26. The company’s legal team conducts a routine compliance review and discovers the camera system. Now the company faces a choice: remove and replace all the cameras before the contract start date, or disclose non-compliance and risk losing the award entirely.

Beyond the operational disruption, there is a more serious legal risk. FAR 52.204-26 requires contractors to annually represent their compliance status. If a company submits an annual representation certifying Section 889 compliance when it actually has covered equipment in use, that false certification creates exposure under the False Claims Act — which carries civil penalties of up to three times the amount of any damages to the government, plus per-claim penalties. This is not a theoretical risk; False Claims Act enforcement related to federal contracting representations has increased substantially in recent years.

How to Determine If Your Organization Is Compliant

Achieving and maintaining Section 889 compliance is a structured process. The following checklist provides a practical framework for contractors at any stage of their compliance journey.

Step 1: Audit Your Physical Security Infrastructure

Walk every square foot of your facility and catalog every security camera, DVR, and NVR. Check the manufacturer name on the hardware itself and cross-reference the model numbers against Hikvision and Dahua’s product catalogs. Pay particular attention to cameras installed by third-party integrators or inherited from previous tenants — brand identity is often obscured or the cameras may be sold under a white-label brand. If you cannot confirm the original manufacturer, treat the equipment as potentially covered until verified otherwise.

Step 2: Audit Your Network Hardware

Document every router, switch, access point, and network appliance on your premises. Huawei and ZTE both produce enterprise-grade networking equipment that is competitive in price and widely distributed through third-party resellers. If your network was built by a managed service provider or IT integrator, request documentation of the hardware installed and verify each device against the covered companies list.

Step 3: Audit Communications Devices

If your organization uses two-way radios, push-to-talk devices, or body cameras for any purpose — facilities management, security, field operations — verify the manufacturer. Hytera is a dominant player in this space, and its devices are sold through numerous resellers and are common in commercial settings.

Step 4: Review Your Supply Chain

If your federal IT procurement involves purchasing hardware or technology products from distributors or resellers, confirm that your vendors have implemented Section 889 compliance controls. Ask for written certifications from your IT distributor confirming that their supply chain is free of products from the five named companies and their subsidiaries. Distributors who source from major authorized channels — such as TD SYNNEX and Ingram Micro — are best positioned to provide this assurance, as these distributors have established compliance programs that screen for prohibited components.

Step 5: Document Everything

For each active federal contract, maintain a compliance file that documents your Section 889 audit results, any remediation actions taken, and the certifications received from your supply chain partners. This documentation is your defense in the event of an audit, a bid protest, or a False Claims Act investigation. Regulators and contracting officers want to see that you have a systematic, documented compliance program — not just a verbal assurance.

Step 6: Submit Accurate Annual Representations in SAM.gov

Every contractor registered in SAM.gov must submit annual representations, which include Section 889 compliance certifications under FAR 52.204-26. These representations must be accurate at the time of submission and remain accurate for the duration of the period they cover. If your compliance status changes — for example, if you acquire a company with covered equipment — you are obligated to update your representation promptly.

What About Products That Contain Components from Covered Companies?

The component-level dimension of Section 889 is one of the most technically challenging aspects of compliance. The law’s language covering “substantial or essential components” and “critical technology” means that a product doesn’t have to carry a Huawei or Hikvision brand name to be covered — it just has to contain a core component manufactured by one of the five named companies or their subsidiaries.

The most prominent example is HiSilicon, Huawei’s semiconductor subsidiary. HiSilicon has produced chips that were embedded in consumer electronics, networking equipment, and other devices under various brand names. While Huawei’s access to advanced chip manufacturing has been significantly curtailed since 2020 due to U.S. export controls, legacy devices with HiSilicon chips remain in circulation and in some supply chains.

GSA and DoD have both issued guidance clarifying the scope of the component-level prohibition, but the guidance acknowledges that determining whether a specific chip constitutes a “substantial or essential component” requires a fact-specific analysis. The practical recommendation from most compliance counsel is to work exclusively with distributors who have invested in supply chain transparency programs and can document the provenance of hardware components. When genuine uncertainty exists, escalate to your contracting officer before making a purchase or certifying compliance.

How One Stop Shop Solutions Inc (OSSS INC) Ensures Section 889 Compliance

One Stop Shop Solutions Inc (OSSS INC) was built from the ground up as a federal-ready vendor. Every aspect of our operations and procurement is designed to support contractors and agencies who need defensible, documented compliance — not just verbal assurances.

We are fully registered in SAM.gov under CAGE Code 9ME14 and UEI QGV1XE1RXLN4, with our SAM registration active through April 2, 2027. Our annual Section 889 representation is on file and accurate — we have no Huawei, ZTE, Hikvision, Dahua, or Hytera equipment in our facilities, our networks, or our product sourcing pipelines. This isn’t a compliance checkbox for us; it’s a fundamental operating requirement we built into the company from day one.

Our product sourcing runs exclusively through TD SYNNEX and Ingram Micro, two of the largest and most rigorously vetted IT distributors in the world. Both distributors maintain active compliance programs that screen for prohibited components, and their supply chains have been evaluated by government acquisition authorities. When you purchase IT equipment through One Stop Shop Solutions Inc (OSSS INC), you’re not just getting a product — you’re getting a documented chain of custody that you can present to a contracting officer or auditor with confidence.

We provide compliance documentation with all government orders, accept Net 30 and Purchase Order payment terms, and are classified as a Small Business — meaning purchases through us can contribute to your small business subcontracting goals. Our primary NAICS code is 334111, covering computer and peripheral equipment manufacturing and distribution. We are also TAA-compliant and Section 889-compliant simultaneously, which is essential because these are two separate standards that both apply to most federal IT procurement. If you’d like to request a quote or discuss your specific procurement needs, our team is ready to assist.

TAA Compliance and Section 889 Compliance — Two Different Standards, Both Required

Federal IT procurement frequently involves two overlapping but distinct compliance frameworks: the Trade Agreements Act (TAA) and Section 889 of the NDAA. It’s important to understand that satisfying one does not satisfy the other — and that a product can fail one standard while passing the other.

The TAA governs the country of manufacture for products purchased with federal funds. Products must be manufactured in the United States or a designated country (countries that have signed trade agreements with the U.S.). China, Russia, and India are not designated countries for TAA purposes, which means products substantially transformed in those countries are generally prohibited for federal purchase. Learn more about how this works in our detailed guide on TAA-compliant products for government IT procurement.

Section 889, by contrast, is specifically about the identity of the manufacturer — not the country of manufacture. A networking device assembled in Taiwan or Germany could still violate Section 889 if its core chipset was manufactured by HiSilicon (a Huawei subsidiary). Conversely, a product can be TAA-compliant (made in a designated country) but still be non-compliant with Section 889 if it contains covered components.

This distinction has practical implications for procurement officers. When evaluating a vendor or a specific product, you need to verify both TAA compliance and Section 889 compliance independently. Working with a single-source vendor who has already integrated both standards into their procurement and documentation processes — like One Stop Shop Solutions Inc (OSSS INC) — significantly reduces your administrative burden and your compliance risk.

Section 889 Compliance Quick Checklist

Use this checklist as a rapid self-assessment tool. If you can answer “yes” to every item, your organization has the foundation of a defensible Section 889 compliance posture.

• ✓ No Huawei, ZTE, Hytera, Hikvision, or Dahua equipment in what you deliver to the government under any federal contract
• ✓ No covered equipment from any of the five named companies (or their subsidiaries) in your own office, facility, or internal network infrastructure
• ✓ Section 889 representations submitted accurately and currently in SAM.gov under FAR 52.204-26
• ✓ Your IT vendor or distributor can provide written certification that their supply chain is free of covered components — including at the chip level
• ✓ Compliance documentation (audit results, vendor certifications, remediation records) is kept on file and available for review in the event of an audit or bid protest
• ✓ Staff responsible for purchasing and facilities management understand the prohibition and know to flag potential covered equipment before it enters the building

Conclusion: Section 889 Compliance Is a Prerequisite, Not an Option

Section 889 compliance has moved from an emerging requirement to a baseline expectation in federal contracting. Contracting officers routinely include FAR 52.204-24, -25, and -26 clauses in solicitations, and both prime contractors and subcontractors are expected to maintain accurate, current representations. The days when “we didn’t know about it” provided any protection are long past.

The good news is that compliance is achievable, and it becomes straightforward when you work with the right partners. One Stop Shop Solutions Inc (OSSS INC) has done the compliance work so that your procurement doesn’t have to start from scratch. We’re SAM-registered, TAA-certified, and Section 889 compliant — with sourcing through TD SYNNEX and Ingram Micro, documentation available for every government order, and a team that understands the practical realities of federal IT procurement.

Whether you’re a prime contractor building a compliant supply chain, a procurement officer looking for a vetted Small Business vendor, or a program manager trying to understand what your contractors need to certify — One Stop Shop Solutions Inc (OSSS INC) is your Section 889-compliant IT and office supply partner. Request a quote today and let us show you how compliant procurement can be efficient procurement.