field note
NDAA camera replacement: selling the compliance swap
NDAA camera replacement removes Hikvision, Dahua, and Hytera video gear from sites bound by Section 889. Who needs it, how to find covered gear, how to plan it.
2026-10-25
NDAA camera replacement is the work of removing video surveillance (CCTV) equipment made by companies named in Section 889 of the FY2019 National Defense Authorization Act, and replacing it with equipment from manufacturers that are not covered. For an integrator, it is a project with a motivated buyer, a clear scope, and a documentation deliverable the customer has to have.
The customers who need it are not always the ones who know they need it. A company that just won its first federal contract, a school district spending grant money on an expansion, or a manufacturer whose largest customer added an NDAA clause to its supplier terms may all be running covered cameras without realizing it.
This post describes how the rules work in practice. Confirm the obligations for a specific customer with their contracting officer or counsel.
What Section 889 covers
Section 889 names five companies: Huawei, ZTE, Hytera, Hikvision, and Dahua, along with their subsidiaries and affiliates. For video surveillance, the covered companies are Hytera, Hikvision, and Dahua. It works in two parts.
- Part A, effective August 13, 2019, bars federal agencies from buying covered equipment.
- Part B, effective August 13, 2020, bars federal agencies from contracting with any entity that uses covered equipment. Contractors represent their status through the FAR clauses (52.204-24, 52.204-25, and 52.204-26), including an annual representation in SAM.
Federal grant and loan recipients are covered separately by 2 CFR 200.216, which bars using federal award funds to buy covered equipment. That reaches into every repair and expansion on a grant-funded site that still runs it.
The FCC Covered List is related but separate. It restricts authorization and marketing of equipment from the same manufacturers. The same names appear in both, which is why the terms get used interchangeably. The NDAA camera checker covers both and lists brands publicly reported to resell covered hardware.
Who needs it
These are the customers worth a conversation, in rough order of urgency.
| Customer | Why it applies | What triggers the project |
|---|---|---|
| Federal prime contractors | Part B: using covered equipment affects eligibility for federal contracts | A new award, a renewal, or the annual SAM representation |
| Subcontractors to federal primes | Flow-down clauses in their subcontracts | A prime’s supplier questionnaire |
| Grant and loan recipients | 2 CFR 200.216 bars spending award funds on covered gear | A grant-funded expansion or repair |
| Private companies with contract or insurer requirements | Customers, parent organizations, or insurers impose the same rule | A supplier audit, insurance renewal, or acquisition |
A private business with no federal contracts and no federal funding is not bound by the statute. Many choose to replace covered equipment anyway because their customers or insurers ask. That is a business decision for them, and a legitimate project for the integrator.
Find the covered equipment
Covered equipment is not always labeled with a covered brand. Hikvision and Dahua have built hardware sold under other names, so a camera with an unfamiliar logo may still be covered.
- Check recorders, not only cameras. An NVR or DVR from a covered manufacturer is covered equipment, even when every camera behind it is not.
- Read the FCC ID on the label. The grantee code at the start identifies the company that obtained the FCC authorization, whatever brand is printed on the housing. The checker shows how.
- Ask the vendor for a written Section 889 attestation naming the specific model, for anything still unclear.
- Record every covered device with site, location, model, serial, and what it records to.
Plan the swap
A compliance replacement has a deadline set by a contract or a grant, so the plan has to show the customer when they will be clear.
- Order by exposure. Sites tied to a federal contract or grant go first. Sites with no exposure can follow on a normal refresh schedule.
- Replace recorders with their cameras. Swapping cameras and leaving a covered NVR in place does not clear the site.
- Reuse what you can. Cabling, and often mounts with adapter plates, carry over. Saying so in the quote keeps the project focused on the equipment that has to go.
- Check VMS compatibility for every replacement model before ordering.
- Keep recording during cutover. Swap a site in stages so coverage of entrances and sensitive areas never goes dark at once.
- Choose manufacturers that are not covered and get the written attestation for each model.
Document as you go
The customer has to sign a representation about the equipment they use, and may be asked to back it up. Hand them the record with the project, not after.
- Every removed device: model, serial, FCC grantee code, location, removal date, and disposal method.
- Every installed device: model, serial, location, install date, and the manufacturer’s attestation.
- A site-by-site completion date.
That record is often what turns a one-time project into an ongoing relationship. The customer will need it updated every time a camera is added or replaced.
Doing this across 500 cameras
On a small site, a technician can read labels and fill a spreadsheet in an afternoon. Across hundreds of cameras and recorders at several sites, the inventory has to be right the first time, because the customer is signing a representation based on it.
MentatNOC does not support NDAA-restricted manufacturers. It is a white-label managed services toolkit for security integrators, and a replacement project is a natural point to add it to the service contract, bundled with the monitoring the integrator already sells. After the swap, every Axis, Bosch, and Hanwha camera under management is tracked by model, firmware, and lifecycle, with every change written to an audit log built so entries cannot be rewritten after the fact. That record stays current as cameras are added or replaced. It monitors device health, not video.
The new cameras are then watched like an alarm panel. When one goes offline or an SD card fails, a classified ticket lands in the integrator’s own ticketing system under their own SLA, naming the camera and the site, so the tech arrives with the replacement model or a card and fixes it on the first trip. Why named-manufacturer hardware draws scrutiny is covered in IP camera vulnerabilities. The layers are on the platform overview, and the live demo shows a fleet inventory.