A federal integrator submitted a $4.7 million physical security proposal last year. It cleared technical evaluation, scored well on past performance, and landed in the top tier of competitive range. Then the contracting officer ran a component-level review and found three Hikvision OEM cameras buried in the video surveillance BOM — rebranded under a distributor's house label. The entire proposal was rejected. Not modified. Rejected. The integrator lost the work, the agency restarted the procurement, and the facility went another eight months without the upgraded perimeter coverage it needed.
That is what NDAA Section 889 non-compliance looks like in practice. Not a fine. Not a warning letter. A lost contract and a delayed mission.
If you are a procurement officer, facility manager, or contracting officer responsible for physical security acquisitions, this is what you need to know before the next solicitation drops.
What Section 889 Actually Prohibits — and Why the Scope Is Broader Than Most People Think
Section 889 of the National Defense Authorization Act for Fiscal Year 2019 established two distinct prohibition tiers. Part A, which took effect August 13, 2019, prohibits federal agencies from directly procuring covered telecommunications equipment or services. Part B, which took effect August 13, 2020, goes further — it prohibits the federal government from contracting with any entity that uses covered equipment anywhere in its internal systems, even if that equipment has nothing to do with the contract itself.
For physical security integrators, Part A is the daily operational concern. The covered entities named in the statute are:
- Huawei Technologies Company
- ZTE Corporation
- Hytera Communications Corporation
- Hangzhou Hikvision Digital Technology Company
- Dahua Technology Company
- Any subsidiary or affiliate of the above
The prohibition applies to cameras, network video recorders, video management systems, two-way radios, and the networking infrastructure that ties these systems together. It does not matter whether the government specifies the equipment or the integrator proposes it. It does not matter whether the purchase is direct or through a subcontractor. If prohibited equipment ends up in a federal system under contract, the contractor is in violation.
Section 889 does not have a grandfather clause for existing contracts. If a task order modification adds scope to a system that already contains covered equipment, the entire system comes back into scope for compliance review.
The FAR implementation — specifically FAR 52.204-24 and 52.204-25 — requires contractors to represent their compliance status in every applicable solicitation and contract. A false representation is not just a compliance issue. It is a False Claims Act exposure event. The downstream risk for prime contractors who do not verify their subcontractor and supplier chains is significant.
The OEM Rebranding Problem That Catches Integrators Off Guard
The hardest part of Section 889 compliance for physical security systems is not identifying Hikvision or Dahua cameras sold under their own brand. That is straightforward. The hard part is identifying the same camera hardware sold under thirty different brand names by distributors who purchase at volume, apply a house label, and push product through the channel.
This is not speculation. It is documented industry practice. Hikvision and Dahua have supplied OEM hardware to hundreds of companies globally. Some of those companies operate in the U.S. government market. When a procurement officer sees an unfamiliar camera brand on a BOM, there is no reliable way to determine country of origin or manufacturer lineage from the product name alone.
The verification methods that actually work include:
- MAC address prefix lookup: Camera MAC addresses are assigned by the IEEE to manufacturers, not to rebranders. A Hikvision OEM unit will carry a MAC prefix registered to Hangzhou Hikvision Digital Technology regardless of what name is on the housing.
- Firmware string analysis: OEM firmware often retains manufacturer-specific strings, model nomenclature, or embedded web interface elements from the source manufacturer.
- Supply chain documentation requests: Require country of origin certificates, manufacturer declarations, and Certificates of Conformance from distributors — not just from the product datasheet.
- Cross-reference against published OEM lists: The Security Industry Association (SIA) and several government-adjacent research organizations maintain running lists of brands with known OEM sourcing relationships to covered entities.
The burden of this verification falls entirely on the integrator, not on the government. If the BOM passes through three distribution tiers and the integrator cannot trace every line item back to a non-covered manufacturer, the risk of non-compliance rides with the prime contractor on the award.
Building a Procurement Process That Survives Contract Officer Scrutiny
Compliance documentation is not something you assemble the night before a proposal is due. By that point, you have already locked in your sourcing decisions, negotiated your pricing, and built your BOM. If a covered component is in that BOM, the only options are a last-minute substitution that breaks your pricing model or submitting and hoping nobody checks. Neither is a strategy.
The process that actually works starts at manufacturer selection, not at proposal assembly. Here is what a defensible procurement process looks like for federal physical security work:
- Maintain a standing approved manufacturer list (AML). Before any solicitation, your organization should have a pre-vetted list of camera, NVR, access control, and networking manufacturers that have been verified as non-covered under Section 889. This list should be reviewed and updated at least quarterly. Ownership structures change. Subsidiaries get added to covered lists. What was compliant eighteen months ago may not be compliant today.
- Require part-number level traceability from every supplier. Not brand-level. Not category-level. Every line item on your BOM should map to a specific manufacturer part number with documented supply chain origin. Your distributor should be able to provide this in writing. If they cannot or will not, find a different distributor.
- Include compliance documentation in the technical proposal. Do not just represent compliance in the FAR certification forms. Show your work. Contract officers who review physical security bids increasingly expect to see a compliance matrix that maps BOM components to manufacturer compliance status. Providing this proactively differentiates your proposal and reduces the likelihood of a post-award challenge.
- Audit subcontractor sourcing before teaming agreements are finalized. If you are priming a contract and using subcontractors for camera installation, low-voltage work, or network integration, you are responsible for their component sourcing. A single non-compliant camera installed by a sub on your job is your violation, not theirs.
- Document the verification process itself. Not just the result. Keep records of when you verified each manufacturer's status, what source you used, and who on your team performed the check. If a compliance question arises post-award, you want to be able to demonstrate a repeatable, documented process — not just assert that you checked.
What Procurement Officers Should Be Asking Integrators Right Now
If you are on the government side of these acquisitions, the representations in a contractor's proposal are only as reliable as the process behind them. An integrator who checks a compliance box without a documented sourcing process is a liability risk for your agency, regardless of how good their technical approach looks.
These are the questions worth asking during technical evaluations or pre-award due diligence:
- Can you provide a BOM with manufacturer part numbers and country of origin for every component in this system?
- What is your process for verifying that distributor-supplied components are not OEM-sourced from covered entities?
- How often do you update your approved manufacturer list, and what triggers a re-verification of existing approved manufacturers?
- If a covered component is identified post-award, what is your substitution and remediation process, and what are the cost and schedule implications?
- Have you had a Section 889 compliance issue on a prior federal contract? If yes, how was it resolved?
An integrator who can answer these questions with specifics — not generalities — has built compliance into their operations. An integrator who gives you a version of "we only use compliant products" without documentation to back it up is telling you they have not thought this through carefully.
The 2023 GSA Schedule mass modification that required all Schedule contractors to re-represent their Section 889 compliance status produced a wave of compliance reviews across agencies. Several vendors who had been operating on Schedule for years could not support their representations and had their contracts modified or terminated. The reviews are not slowing down.
The Bottom Line
Section 889 compliance is a sourcing discipline, not a certification you obtain once and forget. The risk is not abstract. Proposals get rejected. Contracts get terminated. False Claims Act exposure is real for primes who cannot document their supply chain. The integrators who win and keep federal physical security work are the ones who have built compliance verification into their BOM process at the manufacturer selection stage — before pricing, before proposal writing, before the RFP even drops. If your current integrator cannot hand you a compliance matrix with manufacturer-level traceability on every component, that is the conversation you need to have before the next award period.