Electronic Seek
Menu
Sourcing

NDAA Compliant Security Cameras: What to Read on the Spec Sheet

Verify NDAA compliant security cameras before ordering: check FAR 52.204-25 covered entities, HiSilicon SoCs, 47 CFR 2.933 FCC ID grants, and ONVIF fields.

Updated 18 min read
NDAA Camera Spec Check banner with SoC, FCC ID, and ONVIF audit icons beside a camera circuit board and an active RJ45 Ethernet rear interface panel.

Under Federal Acquisition Regulation (FAR) clause 52.204-25, verifying ndaa compliant security cameras requires checking the origin of every component inside the device rather than relying on the brand printed on the housing or a one-line compliance badge on a supplier quotation. Section 889(a)(1)(A) and Section 889(a)(1)(B) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Pub. L. 115-232), implemented in FAR 52.204-25(b)(1) and (b)(2), prohibit executive agencies from procuring or obtaining—and prohibit executive agencies from entering into, extending, or renewing a contract with any entity that uses—any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system.

Under FAR 52.204-25(a), a substantial or essential component means any component necessary for the proper function or performance of a piece of equipment, system, or service. Many surveillance products sold under domestic-sounding brand names are white-labeled hardware built by Hikvision or Dahua that run identical firmware and share HiSilicon chipsets from Huawei’s semiconductor subsidiary, causing procurement files that record only the box brand to fail a Section 889 contract audit.

Before releasing a purchase order for ndaa compliant cameras, network video recorders (NVRs), or video encoders:

  • Separate the marketing name, complete manufacturer model number, manufacturer part number (MPN), and wholesaler SKU into distinct columns and mark each compliance field as confirmed, supplier-stated, conflicting, or not tested.
  • Confirm the System-on-Chip (SoC) vendor on a component-level Bill of Materials (BOM) and verify that the model is free of Huawei subsidiary HiSilicon silicon.
  • Trace the equipment’s FCC ID under 47 CFR § 2.926 and 47 CFR § 2.933 to check whether a private-label camera is a Change-in-Identification rebrand of an existing OEM grant, and inspect the original 47 CFR § 2.1033 internal chassis photographs.
  • Query ONVIF GetDeviceInformation, full firmware build strings, and IEEE MAC OUI prefixes on allocated shipment samples before accepting delivery, and lock the exact MPN and HardwareId on the purchase order.

This guide is part of the electronics sourcing and verification hub. Use the specification comparison guide and its downloadable specification comparison worksheet to structure line-by-line model comparisons, verify the selling entity using how to evaluate a supplier, audit component-level Certificates of Conformance with authorized component distributors vs. brokers, and enforce lot quarantine and inspection milestones with the first-order risk checklist and its downloadable first-order checklist.

Why a Generic “NDAA Compliant” Line on a Quote Fails Audit (FAR 52.204-25)

Under FAR 52.204-25(a), covered telecommunications equipment or services encompass four specific categories tied to a covered foreign country, which the clause defines as The People’s Republic of China.

  • Category 1 (FAR 52.204-25(a)(1) — Telecommunications Equipment): Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation, or any subsidiary or affiliate of such entities.
  • Category 2 (FAR 52.204-25(a)(2) — Video Surveillance and Telecommunications Equipment): For the purpose of public safety, security of Government facilities, physical security surveillance of critical infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company, or any subsidiary or affiliate of such entities.
  • Category 3 (FAR 52.204-25(a)(3) — Covered Services): Telecommunications or video surveillance services provided by such entities or using such equipment.
  • Category 4 (FAR 52.204-25(a)(4) — DoD-Designated Entities): Telecommunications or video surveillance equipment or services produced or provided by an entity that the Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Scroll horizontally to see all columns.

Regulatory Provision Effective Date & Statutory Authority What Is Prohibited for Surveillance & Telecom Buyers Key Procurement Verification Scope
Section 889(a)(1)(A) — Part A (FAR 52.204-25(b)(1)) Effective August 13, 2019 (Pub. L. 115-232) Prohibits the head of an executive agency from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system Applies to all direct federal agency purchases and deliverables supplied to the Government under a contract
Section 889(a)(1)(B) — Part B (FAR 52.204-25(b)(2)) Effective August 13, 2020 (Pub. L. 115-232) Prohibits the head of an executive agency from entering into, extending, or renewing a contract with an entity that uses any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component of any system Applies to a contractor’s internal systems regardless of whether that use is in performance of work under a Federal contract
Federal Grants & Loans (2 CFR 200.216) Federal award regulation (2 CFR 200.216) Prohibits recipients and subrecipients of federal grants or loans (including schools and universities receiving Title I or E-rate funding) from using federal award funds to procure, obtain, extend, or renew contracts for covered telecommunications or video surveillance equipment or services Applies to grant-funded school, university, healthcare, and public-sector camera procurements
GSA SmartPay 889 Representations Search (GSA SmartPay) GSA SmartPay Program (SAM status check) Checks an entity’s Section 889 status in the System for Award Management (SAM) Provides the 889 Representations Search tool to check an entity’s Section 889 status in SAM
FCC Equipment Authorization Ban (47 CFR § 2.903(a)–(c)) FCC Part 2 Subpart J (47 CFR § 1.50002 Covered List) Prohibits all equipment on the FCC Covered List—including equipment incorporating a covered modular transmitter under § 15.212—from obtaining an FCC equipment authorization under certification, Supplier’s Declaration of Conformity (SDoC), or exemption procedures Bars new FCC equipment authorizations for covered cameras, recorders, and devices containing covered modular transmitters or chipsets

Under 47 CFR § 2.903(e), for purposes of implementing the FCC Covered List equipment authorization prohibition, the term affiliate means an entity that directly or indirectly owns or controls, is owned or controlled by, or is under common ownership or control with another entity, where own means to have, possess, or otherwise control an equity interest (or the equivalent thereof) of 10 percent or more. In the same section, 47 CFR § 2.903(e) defines a subsidiary as any entity in which another entity directly or indirectly holds de facto control or owns or controls more than 50 percent of the outstanding voting stock.

As reported by Tom’s Hardware, HiSilicon is a subsidiary of Huawei on the FCC Covered List, and under the FCC’s chip-level rule banning devices based on internal chips rather than individual brands alone, the FCC banned a dashboard camera and a wireless video transmitter from being sold and marketed in the United States because they contained a HiSilicon Smart Vision SoC. In that Tom’s Hardware report, the Hi3516CV610 UHD Smart Vision SoC for surveillance and camera products is equipped with Wi-Fi, Ethernet, video encoding chips, an Arm Cortex-A7 processor, and a Neural Processing Unit (NPU) whose Intelligent Video Engine (IVE) runs a multimodal large model and transformer feature acceleration to track faces, human figures, pets, and parcels across video frames.

Under FAR 52.204-25(c)(2), the equipment exception applies only to telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles. Because networked cameras and recorders actively encode and transmit video streams, they do not fall under the passive routing exception, and two common network workarounds also fail compliance audits:

  • VLAN Segmentation Does Not Satisfy Part B: As documented by Rhombus Systems, network segmentation does not satisfy FAR 52.204-25 because the Part B prohibition applies to covered equipment used as a substantial or essential component of any system regardless of whether a Hikvision camera is isolated on a separate virtual local area network (VLAN).
  • Compliant Cameras Connected to a Covered NVR Fail as a System: Rhombus Systems also notes that if video from compliant cameras is stored on an NVR manufactured by a covered company, the overall surveillance system is non-compliant.

Five Fields to Read on a Security Camera Spec Sheet Before Requesting a Quote

When comparing security camera offers against a supplier quotation, record the marketing name, complete manufacturer model number, manufacturer part number (MPN), and seller SKU in separate columns, and mark each requirement row as confirmed, supplier-stated, conflicting, or not tested. As Systems Integrations states, where a vendor cannot or will not document component origin, buyers must treat the product as unverified because unverified is not the same as compliant in an audit.

Scroll horizontally to see all columns.

Spec Sheet Field What to Require on the Datasheet & Quote Red Flag That Requires Holding the Line Item
1. System-on-Chip (SoC) / Video Processor Named non-covered chipset vendor on the datasheet and component BOM; Coram AI lists Ambarella, MStar, SigmaStar, and Intel as examples of alternative NDAA-compliant camera chips Spec sheet lists HiSilicon (such as Hi3516CV610) or leaves the processor unnamed until component origin is documented
2. Complete Manufacturer Model Number Exact model code checked against the manufacturer’s official NDAA model list; as UMA Technology notes, NDAA compliance applies per model rather than to a brand as a whole Quote supplies only a series name or assumes every model from a non-named brand (such as Uniview) is compliant
3. Producing Entity (OEM vs. Distributor) Disclosure of the producing entity and model identifiers per FAR 52.204-24(e)(1)(i)(A) and (B) (entity name, UEI, CAGE code, whether OEM or distributor, and OEM number, MPN, or wholesaler number) Spec sheet lists only a private-label distributor SKU without disclosing the underlying OEM producer and OEM model number
4. NDAA Section 889 vs. TAA (19 U.S.C. § 2518) Separate verification of FAR 52.204-25 component compliance and Trade Agreements Act (19 U.S.C. § 2518(4)(B)) country-of-origin substantial transformation Datasheet conflates NDAA Compliant with TAA Compliant when the contract requires substantial transformation in the United States or a designated country
5. Equipment Authorization (FCC ID vs. SDoC) Validated FCC ID under 47 CFR § 2.926 or Supplier’s Declaration of Conformity (SDoC) compliant with 47 CFR § 2.903(a)–(c) Covered List prohibitions Device or internal modular transmitter under 47 CFR § 15.212 lacks 47 CFR § 2.903 Covered List clearance

Coram AI notes that any camera including a chipset from Huawei’s HiSilicon brand is not NDAA compliant, identifying Hikvision, Dahua, Lorex, and Amcrest as notable vendors that have used HiSilicon chipsets in their products, while citing Ambarella, MStar, SigmaStar, and Intel as examples of alternative NDAA-compliant chipsets. Systems Integrations documents LTS (LT Security) as a common white-label example where LTS Platinum Series recorders and cameras have been widely documented as OEM hardware sharing firmware lineage with Hikvision, requiring buyers to verify the chipset and firmware origin rather than relying on the domestic brand label.

Procurement teams must also verify NDAA Section 889 and Trade Agreements Act (TAA) requirements as two independent gates:

  • Why TAA Compliance Does Not Prove NDAA Section 889 Compliance: Systems Integrations explains that while NDAA Section 889 bans equipment from specific covered Chinese manufacturers, TAA compliance is a trade rule about where a product is substantially transformed, meaning a camera can be TAA compliant and still fail NDAA if its chipset or firmware originates from a covered entity.
  • Why NDAA Section 889 Compliance Does Not Prove TAA Compliance: Conversely, UMA Technology documents that Uniview (UNV), a manufacturer based in Hangzhou, China, is not named in Section 889 and maintains an official list of NDAA-compliant models including its Prime-I and Prime-III series without HiSilicon chips, yet Uniview does not meet U.S. government TAA or non-China manufacturing requirements.
Close-up of a camera printed circuit board showing the optical CMOS image sensor die mounted beside the square main processor IC package and board connectors.
Component-level verification under FAR 52.204-25 requires confirming the System-on-Chip processor package on the camera circuit board rather than relying on the exterior housing brand.

How to Use FCC ID Filings (47 CFR §§ 2.925–2.1033) to Trace White-Label OEMs

Under 47 CFR § 2.925(a)(1), (d), and (f), equipment covered in an application for FCC equipment authorization must bear a permanently affixed, readily visible nameplate or label (or an authorized electronic label under § 2.935) displaying the term FCC ID in capital letters on a single line followed by the two identifier elements in a legible font not required to be larger than 8-point and at least 4-point unless impractical.

Step 1: Decode the Two-Element FCC Identifier (47 CFR § 2.926 & § 2.925(b))

Under 47 CFR § 2.926(a) through (d), a validated FCC Identifier consists of two elements: a permanently assigned Grantee Code valid only for the party specified as the applicant or grantee (with the required fee under § 1.1103 submitted and validated within 30 days of issuance), followed by a grantee-assigned Equipment Product Code of up to 14 characters consisting of Arabic numerals, capital letters, and dashes or hyphens (-). Under 47 CFR § 2.925(b) and (b)(1), a single FCC Identifier is required for a device consisting of two or more sections assembled in a common enclosure on a common chassis or circuit board with common frequency controlling circuits, whereas sections constructed on separate sub-units or circuit boards with independent frequency controlling circuits may be assigned separate identifiers preceded by TX FCC ID, RX FCC ID, or FCC ID.

Step 2: Check for a 47 CFR § 2.933 “Change in Identification” Filing

Under 47 CFR § 2.933(a) and (b), whenever an applicant files for a change in the FCC Identifier on certified equipment where no change in design, circuitry, or construction is involved, the application need not resubmit measurement or test data, but the applicant must attach a statement setting out five mandatory disclosures:

  1. Original FCC Identification (47 CFR § 2.933(b)(1)): The original identification used on the equipment prior to the change in identification.
  2. Original Grant Date (47 CFR § 2.933(b)(2)): The date of the original grant of the equipment authorization.
  3. Equipment Differences (47 CFR § 2.933(b)(3)): How the equipment bearing the modified identification differs from the original equipment.
  4. Test Result Applicability (47 CFR § 2.933(b)(4)): Whether the original test results continue to be representative of and applicable to the equipment bearing the changed identification.
  5. Exterior Photographs Only (47 CFR § 2.933(b)(5)): Exterior photographs required by § 2.1033(b)(10) or (c)(14) showing the operating controls available to the user and the identification label, while photographs of the internal construction, component placement on the chassis, and chassis assembly are not required to be submitted unless specifically requested.

Step 3: Inspect Original 47 CFR § 2.1033 Form 731 Internal PCB Photos and § 2.911(d)(5) Attestations

Because 47 CFR § 2.933(b)(5) waives internal chassis photographs on a Change-in-Identification filing, buyers tracing a rebranded camera must look up the original FCC ID disclosed under 47 CFR § 2.933(b)(1) to inspect the original certification exhibits. Under 47 CFR § 2.1033(a), (b)(8), and (b)(10) (and (c)(13) and (c)(15)), an original application for certification on FCC Form 731 must include a block diagram showing the frequency of all oscillators in the device and the signal path at each block, schematic diagrams for intentional radiators, and A4 (21 cm × 29.7 cm) or 8 × 10 inch (20.3 cm × 25.4 cm) photographs clearly showing the exterior appearance, identification label, internal construction, component placement on the chassis, and chassis assembly.

Under 47 CFR § 2.911(d)(5) and (d)(7) (and 47 CFR § 2.1033(b)(2)–(4)), every applicant submitting a certification request to a Telecommunication Certification Body (TCB) must provide a written and signed certification that the equipment is not prohibited from receiving an equipment authorization pursuant to § 2.903, include an affirmative or negative statement as to whether the applicant is identified on the Covered List established pursuant to § 1.50002, and designate an agent located in the United States for service of process maintained for no less than one year after the grantee permanently terminates all marketing and importation of the equipment within the United States. Under 47 CFR § 2.903(c)(1)–(3), the Covered List prohibition applies equally to equipment subject to certification procedures, equipment subject to Supplier’s Declaration of Conformity (SDoC) procedures, and equipment otherwise exempt from equipment authorization; when a wired-only camera without wireless transmitters is authorized via SDoC rather than an FCC Form 731 certification grant, verify compliance through the component-level BOM and live protocol checks below.

Weatherproof vandal dome security camera housing mounted beside a steel wall bracket and wired through a liquid-tight conduit fitting to a metal junction box.
Under 47 CFR § 2.933(b)(1) and (b)(5), a Change-in-Identification filing includes photographs showing the exterior appearance of the equipment while internal construction photographs are not required unless requested, requiring lookup of the original identification used prior to the change.

Pre-Shipment & Receiving Verification: ONVIF GetDeviceInformation, MAC OUI, and PO BOM Lock

Systems Integrations specifies six non-destructive technical checks to identify white-label Hikvision or Dahua OEM surveillance hardware without disassembling the unit: inspecting the full firmware version build string, querying ONVIF device information, checking the default web UI layout, looking up the first three octets of the MAC address against the IEEE OUI registry, confirming the SoC family in documentation, and inspecting outbound cloud and P2P service endpoints. In the primary ONVIF Device Management Service WSDL specification (devicemgmt.wsdl), the GetDeviceInformation operation returns a GetDeviceInformationResponse message containing five mandatory xs:string elements: Manufacturer, Model, FirmwareVersion, SerialNumber, and HardwareId.

Scroll horizontally to see all columns.

Verification Check Protocol Field or Physical Target What Exposes a White-Label or Substituted Covered OEM
1. Firmware Version Build String Full build string in the device web interface (Systems Integrations) Rebranded devices frequently retain the original covered vendor’s build naming convention, region code, or date format even when the short version number is changed
2. ONVIF GetDeviceInformation Query GetDeviceInformationResponse (Manufacturer, Model, FirmwareVersion, SerialNumber, HardwareId in devicemgmt.wsdl) The ONVIF response frequently returns the original manufacturer name, board HardwareId, or OEM model code even when the browser web UI has been re-skinned
3. Default Web UI Layout Browser login page, menu tree, and configuration screens (Systems Integrations) White-label resellers rarely rebuild the underlying administrative interface; a login layout and menu tree matching a covered vendor’s codebase signals OEM lineage
4. IEEE MAC Address OUI Lookup First 3 octets of the network interface MAC address (Systems Integrations) Checking the first three octets against the IEEE OUI registry frequently points to the original covered manufacturer’s assigned block rather than the reseller
5. Chipset (SoC) Documentation Component-level Bill of Materials (BOM) and datasheet (Systems Integrations) Presence of HiSilicon parts or a vendor refusal to document the SoC origin leaves the hardware unverified
6. Outbound Cloud & P2P Endpoints Outbound network connections and relay registrations (Systems Integrations) A camera or recorder that registers with a P2P relay or cloud service operated by a covered entity remains functionally tied to that vendor regardless of the label

Building an Audit-Ready Evidence File and Locking Batch BOMs Against Silent Substitutions

Systems Integrations outlines five records required to build an audit-ready Section 889 procurement evidence file for each camera or recorder family: (1) a component-level bill of materials (BOM) naming the SoC, radio modules, and any third-party software components; (2) a signed manufacturer attestation that no covered entity contributed hardware, firmware, or software; (3) the firmware version in service at the time of procurement plus the vendor’s published update cadence; (4) screenshots or exports of the ONVIF device information and firmware build string; and (5) a record of the last firmware update applied and the source it came from.

In ElectronicSeek’s first-order risk checklist, buyers must inspect the goods allocated for the actual order rather than an earlier sales sample, and if a carton or model allocation changes after inspection or the seller proposes a substitute, the buyer must issue a new order revision and reopen the affected checks because an inspection report for a different lot is not a release for the replacement lot. Locking exact component and model identifiers in the purchase order is critical because FAR 52.204-25(d) and (e) impose strict statutory reporting deadlines and subcontract flowdown obligations if a covered component is discovered during contract performance:

  • Mandatory 1-Business-Day Breach Report (FAR 52.204-25(d)(1) & (d)(2)(i)): If a contractor identifies covered telecommunications equipment or services used as a substantial or essential component of any system during contract performance—or is notified by a subcontractor at any tier or any other source—it must report to the Contracting Officer (or the Department of Defense reporting portal for Defense contracts) within one business day from the date of identification or notification: the contract number, order number(s), supplier name, supplier Unique Entity Identifier (UEI, if known), supplier Commercial and Government Entity (CAGE) code (if known), brand, model number (original equipment manufacturer number, manufacturer part number, or wholesaler number), item description, and any readily available information about mitigation actions undertaken or recommended.
  • Mandatory 10-Business-Day Follow-Up Report (FAR 52.204-25(d)(2)(ii)): Within 10 business days of submitting the initial one-business-day report under paragraph (d)(2)(i), the contractor must submit any further available information about mitigation actions undertaken or recommended and describe the efforts it undertook and will incorporate to prevent use or submission of covered telecommunications equipment or services.
  • Mandatory Commercial Subcontract Flowdown (FAR 52.204-25(e)): The contractor must insert the substance of clause 52.204-25, including paragraph (e) and excluding paragraph (b)(2), in all subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial products or commercial services.
Rear interface panel of a network security camera connected to an active RJ45 Ethernet cable with illuminated link and power LEDs beside audio and DC terminal connectors.
Incoming lot check: before releasing a delivered camera shipment into inventory, connect allocated samples over RJ45 Ethernet to capture ONVIF GetDeviceInformation strings, full firmware build strings, and MAC OUI prefixes for that specific lot.

Before releasing payment or accepting a delivered camera lot, record each model’s specification status in the downloadable specification comparison worksheet, log lot-level inspection gates in the downloadable first-order checklist, and consult companion verification workflows in the articles directory and the sourcing and verification hub.

Frequently Asked Questions

Does isolating a Hikvision or Dahua camera on a separate VLAN satisfy NDAA Section 889?

No—as documented by Rhombus Systems, network segmentation on a virtual local area network (VLAN) does not satisfy FAR 52.204-25 because the Section 889(a)(1)(B) prohibition applies to any entity that uses covered equipment as a substantial or essential component of any system, regardless of whether that use is in performance of work under a Federal contract.

What is the difference between NDAA Section 889 compliance and TAA compliance on a security camera spec sheet?

Under FAR 52.204-25, NDAA Section 889 prohibits telecommunications and video surveillance equipment and components produced by named covered entities (Huawei, ZTE, Hytera, Hikvision, Dahua, and their subsidiaries or affiliates such as HiSilicon). Under 19 U.S.C. § 2518(4)(B), the Trade Agreements Act (TAA) is a country-of-origin rule requiring that an eligible product be wholly the growth, product, or manufacture of—or substantially transformed into a new and different article of commerce with a distinct name, character, or use in—the United States or a designated country.

Is Uniview (UNV) NDAA compliant across all camera models?

As UMA Technology documents, Uniview (UNV, based in Hangzhou, China) is not named in Section 889 and offers series without HiSilicon chips—such as Prime-I and Prime-III—on its official NDAA model list, but NDAA compliance applies per individual model rather than to the brand as a whole, and Uniview does not meet TAA or non-China manufacturing requirements.

What are the reporting deadlines under FAR 52.204-25(d) if a delivered camera batch contains a covered component?

Under FAR 52.204-25(d)(2)(i) and (ii), a contractor that identifies covered telecommunications or video surveillance equipment used as a substantial or essential component during contract performance must report the contract number, order number(s), supplier name, supplier UEI and CAGE code, brand, OEM/MPN/wholesaler model number, item description, and initial mitigation actions within one business day, followed by a report detailing further mitigation actions and prevention efforts within 10 business days.

Sources checked

Tags ndaa compliant security camerasndaa compliant camerassecurity camera procurementelectronics sourcing
Continue reading

Related articles