Are You NDAA Compliant? Should You Be? Do You Need to Be?

NDAA Compliance Overview

NDAA compliance refers to adhering to Section 889 of the John S. McCain National Defense Authorization Act (NDAA). This section prohibits the U.S. federal government, its contractors, and recipients of federal grants from procuring or using telecommunications and video surveillance equipment from five banned Chinese companies: Huawei, ZTE, Hytera, Hikvision, and Dahua.

To understand NDAA compliance, it is essential to review its requirements, scope, and implications.

Key Prohibited Manufacturers

The NDAA prohibits the use of equipment, components, and services from the following companies and their subsidiaries due to national security and cybersecurity concerns:

- Huawei Technologies Company

- ZTE Corporation

- Hangzhou Hikvision Digital Technology Company

- Dahua Technology Company

- Hytera Communications Corporation

Who Needs to Comply?

- Federal Agencies: Required to remove banned equipment from their networks.

- Contractors: Companies bidding on or engaged in federal contracts cannot use this equipment in any of their systems.

- Grant Recipients: Organizations receiving federal funding cannot utilize banned equipment.

- Private Sector & Consumers: While there is no legal mandate for private homes or non-federal businesses, many private enterprises and critical infrastructure sites (such as utilities or financial institutions) actively choose NDAA-compliant systems to protect their internal networks from cyber threats and potential backdoors.

How to Verify Compliance

- Review Supply Chains: Ensure that security cameras, drones, or telecom equipment do not rely on essential components or system-on-a-chip (SoC) processors manufactured by the banned companies.

- Manufacturer Declarations: Reputable manufacturers conduct third-party audits and provide documentation confirming that their hardware does not contain prohibited technology.

- Audit Systems: To assess your existing infrastructure, compare your equipment against the guidelines outlined in the Avigilon NDAA Compliance Guide or the Coram AI NDAA Compliance Explanation.

Failure to comply with NDAA requirements can lead to significant consequences, including potential loss of federal contracts, legal repercussions, and reputational damage.