An NDAA-compliant security camera contains no equipment, components, or software from a short list of manufacturers that Congress restricted over national security concerns. The rule started as a federal procurement requirement, but it now reaches private businesses that work with government agencies, universities, hospitals, and contractors in ways many owners do not expect.

Here is what the rule actually covers, who it applies to, and how to check your own equipment.

Where This Rule Comes From

The restriction comes from Section 889 of the National Defense Authorization Act for Fiscal Year 2019. It has two parts, and the difference between them is the reason this matters beyond federal buildings.

Part A, effective August 13, 2019, stops federal agencies from buying or using the restricted equipment themselves.

Part B, effective August 13, 2020, goes further. It stops federal agencies from contracting with any entity that uses the restricted equipment anywhere in its operations, even on work that has nothing to do with the government contract. A landscaping company with a federal maintenance contract can be disqualified over the cameras in its own warehouse.

Contractors confirm compliance through an annual certification in the federal government’s contractor registration system, backed by federal acquisition regulations written specifically for this purpose. If your business holds or wants a federal contract, this certification is a concrete step, not just a policy to be aware of.

Which Manufacturers Are Restricted

The law names a small number of manufacturers, along with their subsidiaries and affiliates, based on national security concerns raised by federal agencies. The restriction is not identical across every named manufacturer.

Some are restricted outright, regardless of how the equipment is used. Others are restricted specifically when the equipment is used for public safety, government facility security, physical security surveillance of critical infrastructure, or other national security purposes. In practice, most commercial and residential security use falls into that restricted category, so the distinction rarely changes the answer for a business evaluating its own cameras.

Because this list can be amended as new entities are added, we recommend checking the current federal Covered List directly rather than relying on any single article to name names. A quick search for “FCC Covered List” will take you to the official, current version.

It Is Not Just Section 889 Anymore

Three separate rules now touch this issue, and a business can be affected by any one of them without ever bidding on a federal contract.

A separate federal regulation applies to any organization that receives federal grant or loan funds, including universities and many hospitals and clinics. It prohibits spending those specific funds on covered equipment. Unlike the procurement waivers available elsewhere in Section 889, this prohibition cannot be waived.

The federal government’s telecommunications regulator maintains its own Covered List and, through a 2022 order, stopped approving new equipment authorizations for the manufacturers on that list, effective February 6, 2023. This is a separate mechanism from the NDAA and it applies nationwide, regardless of whether a business touches federal contracts. It only blocks new product authorizations, though.

Older models authorized before that date could still legally be sold under existing stock, which created a real gap in the rule. Enforcement tightened through late 2025 and into 2026, and that gap has been narrowing as regulators close in on white-label products built on restricted components.

State and local procurement rules increasingly mirror these federal restrictions in their own contract language, even for agencies that never touch federal funds.

How to Actually Check Your Cameras

The name printed on the housing is not always the end of the story. A significant share of affected equipment reaches the market under white-label or private-label products that carry no restricted name at all but were built on restricted circuit boards, sensors, or firmware. This is the detail that trips up most business owners, because they check the label and assume they are clear.

To verify your own equipment or a vendor’s proposal:

Ask the manufacturer directly for written confirmation of Section 889 compliance, not just a verbal assurance.
Ask specifically whether any core components, not just the finished product, originate from a manufacturer on the current restricted list.
Cross-check the equipment against the official federal Covered List rather than relying on marketing claims.
Treat a vendor’s refusal or delay in answering as a red flag. A legitimate manufacturer can produce this documentation quickly.

Why This Matters Even Without a Federal Contract

Even setting the regulatory angle aside, the same backdoors and firmware vulnerabilities that concerned federal agencies do not disappear just because your business is not a federal contractor. If you are curious about the broader security risks of internet-connected cameras generally, we cover that in more depth in how to prevent security cameras from being hacked.

The practical reasons to care go beyond the direct contractor case:

Businesses that supply, service, or partner with federal contractors are increasingly asked to confirm their own equipment before a deal closes.
Universities and healthcare organizations risk losing grant funding eligibility over noncompliant equipment purchased with the wrong funds.
Replacing equipment now, on your own schedule, is easier than an emergency swap forced by a lost contract or a funding review.

What True Home Protection Recommends for Texas Businesses

We work with businesses across Texas that need commercial-grade surveillance without the compliance guesswork. When we design a system, we verify sourcing before it ever reaches your property, and we can review equipment you already have installed.

Our CCTV Video Surveillance Systems for Business and Enterprise are built around commercial-grade hardware selected with both performance and current compliance standards in mind.

Frequently Asked Questions

Does NDAA compliance apply to private businesses that never contract with the federal government?

Not automatically, but the reach is broader than most owners expect. Part B can disqualify you from federal contracts based on equipment you use anywhere in your business, not just on federal work. Separately, the FCC’s rules restrict new equipment sales nationwide regardless of who your customers are. A business with zero federal contracts is not bound by Section 889 directly, but the FCC restriction and the growing list of partners who require compliance mean the practical exposure is wider than the law’s text alone suggests.

Are all cameras made overseas restricted under this rule?

No. The restriction names a specific, short list of manufacturers and their subsidiaries, not an entire country’s manufacturing base. Cameras from manufacturers outside that list are not automatically restricted, though supply chain verification is still good practice given how common white-label rebranding is in this industry.

Can I replace existing noncompliant cameras without overhauling my whole system?

In most cases, yes. True Home Protection can assess your current setup and recommend a path to compliant equipment without requiring you to replace parts of the system that are already fine.

The Bottom Line

NDAA compliance started as a narrow federal procurement rule and has grown into a standard that touches grant recipients, telecommunications equipment approvals, and an expanding list of business relationships that quietly require it. The equipment questions are usually simpler to answer than owners expect, but only once you know which questions to ask.

If your Texas business relies on video surveillance, explore our CCTV Video Surveillance Systems for Business and Enterprise to see how we can help you verify what you have and plan what comes next.