What is Section 889 in plain terms?
The National Defense Authorization Act is a law Congress passes regularly to set defense policy. A section within one such act, known as Section 889, limits what covered telecommunications and video surveillance equipment and services the federal government may procure and use. It focuses on equipment from specific companies named in the law, along with their subsidiaries and affiliates. Think of it as a supply chain restriction, not a technical performance standard. It does not say a camera is accurate or secure, only that certain sources are excluded.
Because the law is detailed and has been interpreted through regulations and guidance, treat this explanation as general background, and confirm the specifics with counsel or your procurement office. The covered companies and the exact categories of equipment are defined in the law and its regulations, and they have been updated over time, so check current official sources instead of relying on a summary from memory. Because of the legal weight of the rule, many buyers adopt it as a simple screening step, even where they could technically choose otherwise.
Who does it affect?
The most direct effect is on federal agencies and on companies that sell to them. The restriction also reaches certain contractors and, depending on the program, organizations receiving federal grants or loans. In practice, state and local agencies, schools, utilities and private firms often adopt the same standard because they depend on federal funding or want to avoid risk. Whether a specific purchase is covered depends on the funding source, the contract terms and the use.
Buyers sometimes require compliance even when no law demands it, as a matter of policy. If you are unsure whether a project is affected, ask your counsel or procurement officer rather than relying on a supplier's marketing claim. Some organizations also ask suppliers to certify compliance periodically, because contracts and funding conditions can require representations that are renewed over the life of an award. If a project uses grant money, read the grant terms carefully, since conditions can attach to the money itself and not only to the buyer.
Why do components matter, not only the brand on the box?
Security hardware is assembled from many parts: image sensors, processors, network chips, modules and firmware, often from different suppliers. A product sold under one label may contain parts from a restricted source, or be a relabeled version of another maker's design. The brand on the case does not settle the question. This is why serious compliance work looks at the whole bill of materials and the manufacturing relationship. A camera, a router, a switch, a recorder and even a power device each carry their own supply chain.
When one component falls within the restricted scope, the system containing it can be affected. Compliance is therefore a property of the complete system, not a single part. Even a compliant brand can rely on restricted components in one model, which is why a statement about a model number is more meaningful than a statement about a company in general. Distinguish between a supplier that has examined its supply chain and one that merely repeats a label; the first can show its work.
How can you verify a supplier's claim?
Ask for a written statement that the product complies with Section 889, and ask what it covers: the complete system or only some parts. Ask whether the product is original design or relabeled, who makes the main processors and modules, and how the supplier checks its own subcontractors. A trustworthy supplier can answer plainly and in writing. Be wary of vague phrases such as NDAA friendly or built to NDAA standards without a clear statement. Keep the documentation with your procurement records.
Compliance claims are only as reliable as the supplier's process, so ask how it handles design changes, new component sources and firmware updates after the sale. Ask also whether support, cloud services and software updates come from compliant sources, since services and software are part of what a procurement rule can reach alongside physical equipment. Ask for the statement to be provided when you buy, not after, so that it is part of the record of the transaction.
What is the right way to use a compliance claim?
Treat it as one criterion in a broader evaluation, alongside security practices, support, interoperability and fit for the site. Compliance with a sourcing rule does not by itself ensure cybersecurity, so still review password handling, update processes, network segmentation and who can access the video. Build the requirement into your purchase documents, so the supplier commits to it contractually, and plan for change: equipment lists, rules and interpretations evolve. For any decision with legal consequences, such as a grant-funded purchase or a federal contract, confirm with counsel or the relevant procurement authority before you buy.
Keep a short checklist: written statement, scope, component sourcing, update process, documentation retained. Review it again whenever you add new equipment to an existing system. If anything in your situation is unusual, such as a mixed system of old and new equipment, take it to counsel before making commitments. A short consultation costs far less than replacing equipment that turns out to be ineligible. Written advice from counsel or procurement also gives you something concrete to show an auditor or grantor later.
Key terms
- NDAA
- The National Defense Authorization Act, a recurring US law that sets defense policy and includes procurement restrictions.
- Section 889
- A provision of one such act restricting government purchase and use of certain telecommunications and video surveillance equipment from named sources.
- Covered equipment
- Equipment or services within the scope of the restriction, as defined by the law and its implementing guidance.
- Bill of materials
- The complete list of components and subassemblies inside a product, used to check where each part comes from.
- Relabeled product
- A device made by one company but sold under another's brand, which can hide its true component origin.
- Supply chain
- The network of suppliers and manufacturers whose parts and services go into a finished product.
For a trailer like this, the question covers everything on the mast and in the cabinet, not just the cameras. VDS states that its Gen 8/9 hardware is NDAA Section 889 compliant, and the trailers are built in Pikesville, Maryland. Buyers with grant or federal requirements should still confirm specifics with counsel or procurement. These details are part of what a buyer should ask about.
Common questions
Does NDAA compliant mean the system is cyber secure?
No. Section 889 concerns where equipment comes from, not how secure it is. You still need good passwords, updates, network separation and access controls. Compliance statements can be tied to a specific model and date, so ask for current documentation.
Do I need NDAA compliant hardware for a private property?
Usually the law does not directly require it for purely private purchases, but contracts, insurers or funding may. Check your obligations with counsel or the relevant authority. Do not assume a product is covered or exempt based on its price or its country of final assembly; check the sourcing.
How do I confirm a supplier is compliant?
Request a written statement covering the full system, ask about component and manufacturing sources, and keep the documents. For legal certainty, have counsel or procurement review the details. A reputable supplier will welcome the question and answer it in writing without hesitation.