NDAA Section 889 compliance for IT hardware: what to ask a reseller

Section 889 is a security rule, not a sourcing rule

Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 is short, sharp, and frequently misread. It does not ask where a device was made. It asks whether specific equipment from specific named companies is present — in what you are buying, and in the systems of the company selling it to you. That distinction is the reason a device can be perfectly compliant with the Trade Agreements Act and still fail a Section 889 review.

It is implemented in FAR Subpart 4.21 and in three clauses and provisions that federal IT buyers see constantly: the prohibition clause at FAR 52.204-25, the offer-level representation at FAR 52.204-24, and the annual representation at FAR 52.204-26. If you buy hardware for an agency, those numbers are worth knowing by sight.

Part A and Part B prohibit different things

Part A — Section 889(a)(1)(A) — prohibits an executive agency from procuring or obtaining, or extending or renewing a contract to procure or obtain, covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. This is the part that governs the thing in the box. It took effect in August 2019.

Part B — Section 889(a)(1)(B) — prohibits an agency from entering into, extending, or renewing a contract with an entity that uses covered telecommunications equipment or services as a substantial or essential component of any system, or as critical technology as part of any system. It took effect in August 2020, and it is the part vendors underestimate. Part B is about the vendor's own operations. It applies whether or not the covered equipment has anything to do with the contract being performed. A reseller with a prohibited camera watching its own warehouse has a Part B problem even if every product it ships is clean.

The covered entities are named in the statute: Huawei and ZTE, and their subsidiaries and affiliates, for telecommunications equipment; and Hytera, Hangzhou Hikvision, and Dahua, and their subsidiaries and affiliates, for video surveillance and telecommunications equipment used for public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national-security purposes. The statute also reaches entities that a designated official reasonably believes to be owned or controlled by, or otherwise connected to, the government of a covered foreign country.

Two more details that change how buyers behave. The prohibition clause at FAR 52.204-25 is prescribed broadly, including for commercially available off-the-shelf items and for acquisitions at or below the micro-purchase threshold — so a purchase-card buy is not outside its reach. And FAR 52.204-25 obliges a contractor that identifies covered equipment or services during performance to report to the contracting officer within one business day, with additional information required shortly after. Waiver authority exists and is narrow. Do not plan a procurement around getting one.

Why it surfaces in IT hardware buys

For a straightforward notebook or desktop order, Section 889 is usually a documentation step rather than a live risk. The questions get real as soon as the buy includes anything with a lens, a radio, or an embedded module:

• Room cameras, video bars, and conferencing endpoints
• Webcams and monitors with integrated cameras
• Physical security and video-surveillance components adjacent to an IT order
• Cellular WWAN and other embedded wireless modules inside notebooks and tablets
• Digital signage players, KVM and AV distribution gear, and network appliances
• White-label or rebadged components where the brand on the bezel is not the manufacturer of the sensor or module inside

Conferencing is where buyers ask most often, and reasonably so — the video-surveillance names in the statute made every camera in a federal conference room a question worth asking. In practice, agencies buying Poly conferencing hardware tend to raise Section 889 earlier and more specifically than they do on a laptop order. That is the right instinct. Ask the question at the configuration level, because a room kit is several devices with several supply chains, not one part number.

The embedded-module case is the one that catches careful buyers off guard. A notebook family can be entirely unremarkable in this respect until someone adds a WWAN option, at which point a new component with its own supply chain enters the configuration. That is precisely why status has to be confirmed against the exact build rather than the model line.

How this differs from TAA and Buy American

These three rules get stapled together in requirements documents and they answer completely different questions.

• Section 889 asks whether covered equipment or services from the named entities are present. It is a security prohibition, and country of manufacture is not the test.
• The Trade Agreements Act asks where the product was manufactured or substantially transformed, and applies to certain procurements. Our guide to TAA compliance for government laptop buys covers what to check.
• The Buy American Act is a domestic-preference framework with its own thresholds, evaluation preferences, and waivers — a preference regime, not a flat prohibition.

The practical consequence: a device can satisfy TAA and still be a Section 889 problem if it embeds a covered module, and a device that is not TAA-compliant for your procurement may present no Section 889 issue at all. Compliance with one is not evidence of the other. When you write the requirement, name each rule you actually mean, and require the response to address each one separately.

What to ask a reseller for

Ask for these specifically. A vendor who handles federal work regularly will not blink at any of them.

• The representation in the offer. FAR 52.204-24 requires an offeror to represent whether it will provide covered telecommunications equipment or services, and, having conducted a reasonable inquiry, whether it uses them. Require it on the offer, not as a verbal assurance.
• The annual representation in SAM. FAR 52.204-26 covers the representation maintained in the System for Award Management. Check that the vendor's registration is active and the representation is current.
• Per-line, per-configuration confirmation. Not a brand-level statement. The confirmation should attach to the specific SKU and build you are ordering, in writing on the quote.
• Component-level questions on anything with a camera or a radio. Cameras, video bars, embedded WWAN, wireless modules, and any AV component in a room kit deserve to be asked about by name.
• Re-confirmation when the configuration changes. A swapped option can introduce a new component and a new supply chain.
• The vendor's Part B posture. Ask whether they have conducted the reasonable inquiry into their own systems, because Part B is about the vendor entity, not only the product.

If a vendor answers at the brand level, waves the question off as already handled, or offers a blanket statement covering an entire catalog, slow down. Nobody can honestly certify a whole catalog in advance.

The honest process note

We confirm Section 889 status per line and per configuration at quote time, based on manufacturer confirmation for the exact build you are ordering, and we put it in writing on the quote. We make the FAR 52.204-24 representation on the offer, and we maintain the annual representation in SAM.

What we will not do is publish a blanket claim that everything we sell is Section 889 compliant. It would be easy marketing and it would be wrong. Configurations change, options introduce new components, and the only defensible answer is the one attached to a specific build on a specific date. Any HP security capability we mention is HP's, not ours — our job is to confirm status accurately on the line you are actually buying and to flag anything that cannot meet the requirement rather than quietly substituting around it.

If a line cannot meet your requirement, you should hear it from us before award, not from a review afterward. That is the whole standard, and it is the same one we apply to TAA on every government quote. More about how we support agency buyers is on our federal page.

Send us the configuration and we will confirm compliance status line by line. Request a Section 889 confirmed quote and tell us which rules your requirement invokes — 889, TAA, Buy American, or all three — so the response addresses each one separately.