DecipherU
Sign inStart practicing

National Defense Authorization Act Section 889

US FederalGovernment & Public Sector2019
ByDecipherU Editorial

NDAA Section 889 prohibits US government agencies from procuring cybersecurity and telecommunications equipment from specified Chinese manufacturers (Huawei, ZTE, Hytera, Hikvision, Dahua). This cybersecurity supply chain law also prohibits agencies from contracting with entities that use covered equipment. It applies to both direct purchases and contractor systems.

Quick Reference

EnactedPart A effective August 13, 2019; Part B effective August 13, 2020
Enforcement BodyDoD, GSA, NASA, agency contracting officers
PenaltiesContract termination, debarment from government contracting
Applicable ToFederal agencies and their contractors and subcontractors

Key Requirements

Section 889(a)(1)(A)

Agencies may not procure covered telecommunications equipment or services from specified entities

Section 889(a)(1)(B)

Agencies may not contract with entities that use covered equipment as a substantial or essential component

FAR 52.204-25

Contractors must represent whether they use covered telecommunications equipment and report any discoveries during contract performance

How Does NDAA § 889 Affect Cybersecurity Careers?

Supply chain security analysts must audit hardware and software inventories for prohibited equipment. GRC analysts at defense contractors need to verify Section 889 compliance in their supply chains. Security architects must design solutions that exclude covered equipment.

How Does NDAA § 889 Affect Cybersecurity Sales?

Cybersecurity vendors must certify their products do not contain components from covered entities. Supply chain risk management platforms can position Section 889 compliance as a use case. Sales teams selling to federal buyers should proactively address Section 889 in proposals.

Cybersecurity Roles That Work With NDAA § 889

GRC Analyst→Security Architect→Chief Information Security Officer→

Related Cybersecurity Certifications

CISSPCISM

Related Cybersecurity Laws

NIST Special Publication 800-171 / Cybersecurity Maturity Model Certification→Federal Information Security Modernization Act→

Read the full text of NDAA § 889 at the official source: https://www.congress.gov/bill/115th-congress/house-bill/5515/text

Frequently Asked Questions

NDAA Section 889 prohibits US government agencies from procuring cybersecurity and telecommunications equipment from specified Chinese manufacturers (Huawei, ZTE, Hytera, Hikvision, Dahua). This cybersecurity supply chain law also prohibits agencies from contracting with entities that use covered equipment. It applies to both direct purchases and contractor systems.

Supply chain security analysts must audit hardware and software inventories for prohibited equipment. GRC analysts at defense contractors need to verify Section 889 compliance in their supply chains. Security architects must design solutions that exclude covered equipment.

Contract termination, debarment from government contracting

Sources

  1. Official text: NDAA § 889
Last verified: April 2026?Report an inaccuracy

Explore Related Cybersecurity Resources

Career GuideGrc Analyst cybersecurity career guideRead the full career guide for Grc Analyst rolesCareer GuideSecurity Architect cybersecurity career guideRead the full career guide for Security Architect rolesCertificationCissp cybersecurity certification guideCost, exam format, and career impact detailsLawNist Sp 800 171 cybersecurity law summaryRequirements, penalties, and career impact

Was this page helpful?

Cybersecurity law and regulation summaries are educational plain-language descriptions, not legal advice. Statutes, regulations, and enforcement guidance change frequently. Consult qualified legal counsel and verify against the official published text before relying on any summary for compliance or career decisions.