La conformità NDAA, nel contesto della sicurezza fisica, significa che le telecamere di sorveglianza, i registratori, il software VMS e i componenti associati non contengono apparecchiature prodotte da un elenco definito di produttori cinesi vietati. Se la tua organizzazione detiene un contratto federale, riceve finanziamenti federali, opera come subappaltatore in lavori governativi o ha intenzione di farlo, ogni telecamera sulla tua rete è una questione di conformità.
The National Defense Authorization Act (NDAA) is the annual US federal law that sets the budget and policies for the Department of Defense. Section 889 of the FY2019 NDAA, signed into law on 13 August 2018, introduced specific restrictions on telecommunications and video surveillance equipment that have significant implications for the physical security industry worldwide.
The law contains two distinct prohibitions, commonly referred to as Part A and Part B.
Part A (effective 13 August 2019) prohibits federal agencies from directly procuring or obtaining telecommunications or video surveillance equipment from covered manufacturers.
Part B (effective 13 August 2020) is broader and more consequential for the private sector. It prohibits federal agencies from entering into contracts with any entity that uses covered equipment in its systems — regardless of whether that use is related to the federal contract in question. In practical terms: if you sell anything to the federal government or receive federal funding, you cannot have prohibited cameras anywhere on your network.
Federal Acquisition Regolamento (FAR) 52.204-25 rende operativi questi divieti in tutti i contratti federali al di sopra della soglia di microacquisto. Ogni appaltatore deve dichiarare di non utilizzare attrezzature coperte. Questa rappresentazione si applica all'intera organizzazione, non solo al lavoro appaltato.
La sezione 889 nomina cinque società cinesi e vieta le loro apparecchiature come componente sostanziale o essenziale di qualsiasi sistema:
The ban extends to all subsidiaries and affiliates of each named company. For Hikvision and Dahua specifically, this is a very long list that includes regional entities, OEM arrangements, and brands that resell Hikvision or Dahua hardware under different names without disclosing the underlying manufacturer.
The FCC reinforced the ban in 2022 by prohibiting new equipment authorisations for all five companies. This means even previously authorised Hikvision and Dahua equipment can no longer be updated or replaced with like-for-like hardware in compliant deployments.
OEM la rietichettatura non è una difesa. Se una telecamera è prodotto da Hikvision o Dahua — o contiene componenti come chipset o sensori prodotti da queste aziende — è coperto dal divieto indipendentemente dal marchio sulla confezione. Alcune fotocamere vendute con nomi di produttori non vietati utilizzano chipset HiSilicon, una filiale di Huawei. Le apparecchiature contenenti questi componenti possono creare rischi di conformità anche quando il produttore della fotocamera stesso non è menzionato.
The reach of Section 889 is wider than most organisations initially assume.
Agenzie federali— all US federal agencies and departments cannot purchase or use covered equipment directly.
Appaltatori federali— any company holding a federal contract, at any tier, cannot use covered equipment in any of its systems. This applies regardless of whether the system in question is used in performance of the federal contract. A Hikvision camera in a warehouse unrelated to federal work still creates a compliance issue for a company that holds federal contracts elsewhere.
Destinatari di sovvenzioni e prestiti federali— organisations receiving federal funding, including schools, hospitals, universities, and local authorities that accept federal grants, cannot use federal funds to purchase covered equipment. 2 CFR 200.216 codifies this separately from the contractor prohibition.
Subappaltatori— if your prime contractor holds a federal contract, Section 889 flows down. A subcontractor two or three tiers removed from a federal prime is subject to the same restrictions.
Regno Unito e internazionale implicazioni— sebbene la Sezione 889 sia una legge federale statunitense, i suoi effetti sono globali per qualsiasi organizzazione esposta alla catena di fornitura del governo statunitense. Anche il governo del Regno Unito ha implementato le proprie restrizioni, imponendo ai dipartimenti del governo centrale di rimuovere le apparecchiature Hikvision e Dahua dai siti sensibili. Canada, Australia e diversi Stati membri dell’UE hanno introdotto restrizioni parallele. Le organizzazioni che riforniscono uno qualsiasi di questi mercati dovrebbero applicare un controllo equivalente alla loro catena di fornitura di fotocamere.
Affinché un sistema di sicurezza sia conforme a NDAA, ogni componente nello stack deve essere privo di contenuti del produttore coperti:
È qui che una piattaforma aperta VMS diventa fondamentale per la conformità NDAA. Uno VMS chiuso o proprietario che richiede fotocamere di un produttore specifico crea un unico punto di rischio: se quel produttore è nell'elenco proibito o utilizza componenti vietati, l'intero sistema non è conforme. Una piattaforma aperta VMS che funziona con qualsiasi fotocamera compatibile con ONVIF offre ai team di procurement la libertà di specificare solo hardware verificato e conforme e di sostituire le fotocamere man mano che il panorama della conformità si evolve, senza sostituire l'intera piattaforma.
Wavestore's VMS software — WaveView and WaveFusion — is developed and maintained in the United Kingdom and contains no components from any NDAA-prohibited manufacturer. As an open-platform VMS, Wavestore does not require cameras from any specific manufacturer. Security teams can specify cameras from any NDAA-compliant manufacturer that supports ONVIF, with full confidence that the management layer will not introduce supply chain risk.
La libreria di integrazione delle telecamere includes NDAA-compliant models from Axis, Hanwha Vision, Bosch Security Systems, and many other manufacturers — all verified against open-platform compatibility. When an organisation needs to migrate away from non-compliant cameras, Wavestore's architecture allows phased replacement: compliant cameras can be added to an existing deployment without disrupting the management layer.
Per contratti federali statunitensi, infrastrutture critiche e progetti adiacenti al governo, il team di Wavestore può fornire su richiesta la documentazione di provenienza della catena di fornitura. Parla con il team americano di Wavestore per supporto sulla conformità NDAA su progetti specifici.
Se la tua organizzazione detiene o sta perseguendo contratti federali, i seguenti passaggi forniscono un punto di partenza pratico. Questa non è una consulenza legale: consulta professionisti legali e di conformità qualificati per una guida specifica per la tua situazione.
Does NDAA compliance apply to private companies?
Yes, if they hold federal contracts, subcontracts, or receive federal grants or loans. Section 889(a)(1)(B) applies to any entity that uses covered equipment in systems tied to federal work, regardless of whether the entity is a government agency. A private company with a single federal subcontract faces the same restrictions as a DoD facility.
Are Hikvision cameras NDAA compliant?
No. Hangzhou Hikvision Digital Technology Co. is explicitly named in Section 889 as a covered company. Hikvision cameras — including all OEM relabels — are prohibited from federal procurement and from use in any system connected to federal contracts or funding.
Are Dahua cameras NDAA compliant?
No. Dahua Technology Co. is also explicitly named as a covered company under Section 889 and is subject to the same prohibitions as Hikvision.
Does NDAA compliance extend to the UK?
Section 889 is US federal law. However, the UK government has implemented its own restrictions: central government departments have been directed to remove Hikvision and Dahua equipment from sensitive sites, with Scotland, Wales, and multiple UK police forces having initiated replacement programmes. UK organisations supplying into US federal supply chains are subject to Section 889 through the contractor prohibition. Wavestore, as a UK-developed VMS, contains no components from any named prohibited manufacturer.
What happens if non-compliant equipment is found after a contract is signed?
Federal contractors who misrepresent compliance under FAR 52.204-25 face contract termination, civil penalties, and potential debarment from future federal work. The statute of limitations for False Claims Act violations is up to ten years. The risk of retroactive enforcement makes proactive auditing a business priority, not just a compliance checkbox.
Can NDAA-prohibited cameras be used if isolated on a separate network?
No. Section 889(a)(1)(B) applies to covered equipment used as a substantial or essential component of any system, regardless of whether that use is in performance of the federal contract. Network segmentation does not satisfy the statute.
Is Wavestore NDAA compliant?
Yes. Wavestore's VMS software is developed in the United Kingdom and contains no components from any NDAA-prohibited manufacturer. As an open-platform system, it operates with cameras from any ONVIF-compliant manufacturer, allowing procurement teams to specify verified compliant hardware independently of the VMS. Contact Wavestore's Americas team for project-specific supply chain documentation.
NDAA Section 889 prohibits federal agencies, contractors, subcontractors, and grant recipients from using surveillance equipment produced by Hikvision, Dahua, Huawei, ZTE, or Hytera — including OEM relabels and equipment containing components from these manufacturers. The ban extends to the entire organisation, not just the work performed under federal contract.
For security integrators and end users, NDAA compliance starts with knowing exactly what is in your camera stack and extends to the VMS layer. An open-platform VMS that does not lock you into a single camera manufacturer is the correct foundation for a compliant, future-proof surveillance architecture.
Wavestore's open-platform VMS and NDAA-compliant hardware range give security teams the freedom to specify verified compliant cameras and the flexibility to replace hardware as the regulatory landscape evolves — without replacing the management platform.
Contatta il team americano di Wavestore per il supporto per la conformità NDAA o esplora il VMS a piattaforma aperta di Wavestore per capire come protegge la tua flessibilità di approvvigionamento.