The cheap camera that can cost you a federal contract.

If your company wants to sell to the US government — directly, or as a subcontractor to someone who does — there is a rule that can disqualify you before anyone even reads your proposal. It has nothing to do with your technical ability or your price. It is about the cameras on your wall and the routers in your rack.

What Section 889 actually says

Section 889 of the 2019 National Defense Authorization Act prohibits federal agencies from contracting with any company that uses certain Chinese-made telecommunications and video-surveillance equipment — even if that equipment has nothing to do with the government work, and even if it only sits quietly in your own back office. The named companies are Huawei, ZTE, Hytera, Hangzhou Hikvision and Dahua Technology, along with their subsidiaries and affiliates.

Two things make this trickier than it looks. First, it is a ban on use, not just on supply. You do not have to sell the government a Hikvision camera to fall foul of it — you only have to have one running in your own building. Second, when you register in SAM.gov and every time you bid, you certify that you have done a "reasonable inquiry" and do not use this equipment. That certification is signed under the same statute that makes a false statement to the federal government a criminal matter. Getting it wrong is not a paperwork slip.

Why a $40 camera is the trap

Here is the part that catches people. Hikvision and Dahua are two of the largest camera manufacturers on earth, and they do not only sell under their own names. They manufacture for dozens of other brands that rebadge the same hardware. That inexpensive IP camera you bought online three years ago, the one with a brand you had never heard of, is very often a Hikvision or Dahua board inside a different shell. The logo on the box tells you nothing.

So a company can certify in complete good faith that it does not use covered equipment, while a rebadged covered camera watches its own front door. The rule anticipates exactly this — which is why it asks for a reasonable inquiry, not a guess. "We did not think we had any" is not a defence if you never actually looked.

How to check in an afternoon

The good news is that a reasonable inquiry is genuinely achievable for a small company in a single afternoon, and doing it produces the evidence you need. The approach is straightforward: physically walk the building and inventory every camera, network video recorder, router, switch and radio. For each device, find the true manufacturer of the hardware, not the brand on the label — chipsets, default firmware pages, and known rebadge lists will usually tell you. Cross-reference against the covered list. Then write it down, with the date. That dated inventory is your proof of reasonable inquiry.

If you find something covered, replace it before you certify — and keep the receipt. Non-covered alternatives are easy to find; TP-Link, Ubiquiti and MikroTik network gear, for example, are not on the list. The cost of swapping a camera is trivial next to the cost of a false certification.

Where we fit

This is exactly the kind of unglamorous, high-consequence detail that sits in the gap between "IT" and "security" — and it is the gap we were built to close. A §889 audit is a small piece of work with an outsized downside if it is skipped. If you are heading toward federal or subcontract work and want the inventory done properly, with the documentation that stands up later, that is a short engagement we do often.

Talk to us about a §889 audit See our federal capabilities

This article is general information, not legal advice. For a determination on your specific situation, confirm against the current regulation and, where the stakes warrant it, your counsel.