NDAA Section 889 Banned List: The 5 Companies and 146 Reported Names

By The Defense Compliance Report Editorial Team · Updated September 2026

The NDAA Section 889 banned list names five companies: Huawei, ZTE, Hytera, Hikvision, and Dahua, plus their subsidiaries and affiliates. The FCC's 2025 appendices contain 146 other reported names after de-duplication, according to The Defense Compliance Report's September 2026 count. The tables below show every name and its source. Law · FCC source

Five-company table · Download all names · Copy a citation

Key Section 889 banned list statistics

• 146 linked firms. The five Section 889 companies have named 146 subsidiaries, affiliates, and related firms in their own filings with the Federal Communications Commission (FCC), according to The Defense Compliance Report's count of FCC Advisory DA 25-927 (lists as of Sept. 22 and Oct. 10, 2025).
  Copy statisticCopy sourceCopy link
• 89% are in Dahua's reported group. Dahua accounts for 130 of the 146 linked-firm names (89%) in the 2025 FCC appendices; Hikvision accounts for 9, Hytera 4, Huawei 2, and ZTE 1 (Defense Compliance Report count of FCC DA 25-927, checked Sept. 29, 2026).
  Copy statisticCopy sourceCopy link
• 40% lack the parent brand. Of 146 reported linked-firm names in the 2025 FCC appendices, 59 lack their own parent brand string—Huawei, ZTE, Hytera, Hikvision, or Dahua (Defense Compliance Report name-string count of FCC DA 25-927, checked Sept. 29, 2026).
  Copy statisticCopy sourceCopy link
• About 700 at GSA. The General Services Administration (GSA) had an internal list of about 700 subsidiaries and affiliates of the five companies as of May 2026, and the Government Accountability Office (GAO) found GSA and the Defense Department (DoD) do not share such information broadly (GAO-26-108630, Sept. 22, 2026).
  Copy statisticCopy sourceCopy link
• 5 companies in the law. Section 889 of the FY2019 National Defense Authorization Act (NDAA) covers certain telecom and video surveillance gear and services from Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company (FAR 52.204-25, checked Sept. 29, 2026).
  Copy statisticCopy sourceCopy link
• About 1,800 contractors say "yes." About 2% of companies in GAO's fiscal year 2025 contracting population, roughly 1,800, told SAM.gov they use covered equipment; almost 90% said they don't (GAO-26-108630, March 2026 SAM data). GAO included prime contracts, other transaction agreements, and reported subcontracts.
  Copy statisticCopy sourceCopy link
• 131 contracts ended. GSA terminated 131 contracts with companies that would not accept a modification adding the Section 889 clause, as of May 2026 (GAO-26-108630, published Sept. 22, 2026).
  Copy statisticCopy sourceCopy link
• About 137,000 products blocked. From October 2025 to May 2026, GSA's systems flagged about 137,000 products as noncompliant with prohibitions including Section 889 before they reached its catalogs (GAO-26-108630, published Sept. 22, 2026).
  Copy statisticCopy sourceCopy link
• 3 of 5 on the Pentagon's other list. Our parsing of the Defense Department's June 10, 2026 "Chinese military companies" notice (the 1260H list) counts 188 entities, including 3 of the 5 expressly named Section 889 companies: Huawei, Hikvision, and Dahua (Defense Compliance Report count of 91 FR 35189).
  Copy statisticCopy sourceCopy link
• 1 business day or 72 hours. The standing Federal Acquisition Regulation (FAR) clause gives 1 business day after its specified identification or notification; the FAR overhaul model gives 72 hours after its own reporting trigger (52.204-25(d); model 52.240-91(h)). The actual contract selects the rule.
  Copy statisticCopy sourceCopy link
• 2019 and 2020 start dates. Part A of Section 889 took effect Aug. 13, 2019; Part B took effect Aug. 13, 2020 (FAR 52.204-25(b)).
  Copy statisticCopy sourceCopy link
• 29 agencies moved it. As of July 2026, 29 federal departments and agencies had issued class deviations moving Section 889 into a new FAR Part 40 (GAO-26-108630, published Sept. 22, 2026).
  Copy statisticCopy sourceCopy link

On this page: The 5 companies · The 146 linked firms · GSA's list · 1260H list · Part A vs. Part B · Grants · Exceptions · Clauses and reporting · Contractor data · Other lists · Cameras · Check a vendor · Timeline · Method · Cite · Download · FAQ

Which companies are on the Section 889 banned list?

Section 889 names five companies: Huawei, ZTE, Hytera, Hikvision, and Dahua. The definition also covers their subsidiaries and affiliates, the specified related services, and equipment or services from a company the Defense Secretary reasonably determines has the required ties to China's government after the consultation described below. The same five names appear word for word in the current contract clause and the federal grant rule, checked Sept. 29, 2026.

Here's the short version of who's on it and what each name covers.

Source: FAR 52.204-25(a); FCC DA 25-927, counted by The Defense Compliance Report; 91 FR 35189; FCC Covered List. All checked Sept. 29, 2026.

Scope: The 146 names come from the 2025 FCC appendices, not a current product blacklist. Section 889 applies the substantial-or-essential-component or critical-technology test, with its stated exceptions and waivers. A name match alone does not decide a product's status.

What "subsidiary or affiliate" means here

The law says "any subsidiary or affiliate" of the five. It doesn't list them. The FAR overhaul text defines a subsidiary as a company more than 50% owned by the parent, directly or through another subsidiary (FAR 40.201, deviation). "Affiliate" isn't defined in that section. The next section shows the names the companies reported, not an independent legal test of affiliation.

The security-purpose limit for Hytera, Hikvision, and Dahua

Huawei and ZTE telecom equipment has no security-purpose qualifier in this definition. The system test, exceptions, and waivers still apply. For Hytera, Hikvision, and Dahua, the law adds a purpose: video surveillance and telecom gear used for public safety, security of government facilities, physical security surveillance of critical infrastructure, and other national security purposes. Say a Dahua camera watches a federal building's lobby. That's the core case the law describes. If your contract is unclear about a different use, ask your contracting officer in writing.

The fourth route: companies the Defense Secretary names

The definition has one more door. It covers gear or services from any company the Secretary of Defense, after consulting the Director of National Intelligence or the FBI Director, reasonably believes is owned, controlled by, or connected to China's government. Under the FAR overhaul text, the Defense Department records those companies in SAM.gov (FAR 40.204-2, deviation).

Which subsidiaries and affiliates are on the list?

The five Section 889 companies reported 146 other names in the 2025 FCC appendices, by our count. Dahua accounts for 130 of them, or 89%. Here, 'linked firms' means reported subsidiaries, affiliates, or associated entities—not an independently verified current list. The FCC says the appendices aren't complete.

Where do these names come from? In October 2025, the FCC published names the five companies had submitted under its equipment-authorization reporting rules, including 47 CFR 2.903(b), in two appendices (FCC DA 25-927). The filings do not all use the same scope: Dahua's broader list includes associated entities without saying which make communications gear. We transcribed and checked the names, removed duplicates, and counted.

Here are the 19 linked firms from the FCC's first appendix. Dahua's other 127 are in the full, searchable table below and in the download.

Source: FCC DA 25-927, Appendix A. The FCC also lists "Huawei Technologies Co. Ltd." under Huawei; that is Huawei's own formal name, so we don't count it as a separate firm. The court caption and introduction distinguish Huawei Technologies Company, Limited from Huawei Technologies USA. Checked Sept. 29, 2026.

A parent-brand text check misses 2 in 5

Here's the trap. Of the 146 reported linked-firm names, 59 don't contain their own parent's brand string. That's 40%, or about 2 in 5. This tests the name text only; it does not show intent to hide an affiliation. Search a vendor list for "Hikvision" and you'll find Hikvision USA, but you'll miss the other 8, including two EZVIZ companies, Hikmicro, and Hikrobot. Search for "ZTE" and you'll miss Nubia. Search for "Hytera" and you'll miss Norsat, Teltronic, and HMF Smart Solutions.

Source: The Defense Compliance Report analysis of FCC DA 25-927. A name "carries the brand" if it contains the brand spelled out, ignoring capital letters and punctuation. Checked Sept. 29, 2026.

Why Huawei's list is so short

Our Huawei count is two other reported names. The FCC's footnote explains the limits of Huawei's disclosure. Huawei's U.S. unit said it disclosed voluntarily and argued the FCC has no power to require information about entities outside the United States (FCC DA 25-927, footnote 4). So "2" is what Huawei chose to share. It isn't a count of Huawei's affiliates.

Why Dahua's list is so long

Dahua went the other way. In a September 22, 2025 filing, it listed 129 "associated entities," from Dahua Technology UK to investment partnerships. But the FCC notes Dahua didn't say which of those make communications gear (FCC DA 25-927, footnote 3). A name on Dahua's list tells you Dahua reported it as associated in September 2025. It doesn't establish current ownership or tell you every product is covered.

Look up a company name

Use the full name tables below, or download either CSV and search a company name. They cover the 146 reported linked-firm names, the five companies named in the law, Huawei's formal-name row, and our 188-entity parsing of the June 2026 1260H notice. A match shows where a name appears—not product approval. No match is not a clearance.

What the list leaves out

Three things. First, the FCC says its appendices are not a complete list of every subsidiary or affiliate (FCC DA 25-927, page 3). Second, the lists are as of September and October 2025; companies buy, sell, and rename units. Third, Hikvision's filing lists affiliates that make gear subject to FCC equipment-authorization rules whether or not that gear is covered (footnote 7). So use the list to find links, then check the product.

Does GSA have a list of subsidiaries and affiliates?

Yes. GAO found it was not broadly shared with other federal agencies. GSA told auditors it had built a list of about 700 subsidiaries and affiliates of the five companies as of May 2026, using commercial supply chain tools, search algorithms, origin tracing, and news alerts. GAO found GSA and the Defense Department don't broadly share that kind of information with other agencies (GAO-26-108630, Sept. 22, 2026).

That leaves a big gap. The 2025 FCC appendices contain 146 other reported names after our de-duplication. GSA officials reported about 700 subsidiaries and affiliates as of May 2026. The dates and methods differ; we have not matched the two lists. One industry group told GAO the "continued lack of a list of covered affiliates and subsidiaries" strains compliance. The Defense Department told GAO it doesn't keep a central list at all, because corporate structures change too fast.

GAO recommended that GSA and the Defense Department share their subsidiary and affiliate information with other agencies. Both agreed. GAO's recommendation tracker showed all four as open when checked Sept. 29, 2026. If that information is ever published, we'll add it here with its date.

Is the Pentagon's 1260H list the same as the Section 889 list?

No. The 1260H list is the Defense Department's list of "Chinese military companies" under a different law, the FY2021 NDAA. Our parsing of its June 10, 2026 notice counts 188 entities and finds 3 of the 5 expressly named Section 889 manufacturers: Huawei, Hikvision, and Dahua. ZTE and Hytera are not expressly named in that notice.

The two lists get mixed up. Both are China lists tied to defense bills. Some published "Section 889 banned lists" actually reproduce the 1260H list. Here's how they line up.

Source: Defense Compliance Report review of 91 FR 35189 (June 10, 2026). Checked Sept. 29, 2026.

So checking one list doesn't clear the other. ZTE is expressly named in Section 889 but not in this 1260H notice. TP-Link Technologies Co., Ltd. appears in the notice but is not one of Section 889's five express names. Neither comparison clears a product or every related entity.

How we got 188: we counted 80 parent listings and 108 named subsidiaries. 80 + 108 = 188. One line runs “COMAC America Corporation” into “Shanghai Aircraft Design and Research Institute.” We split it because COMAC's own profile lists its America Corporation separately from its Design and Research Center. An unsplit reading gives 187. Former names and abbreviations do not add entities. The same notice removed 10 companies that were on the January 2025 list.

Section 805 ties the 1260H list to defense-contract restrictions. Since June 30, 2026, the Defense Department may not sign, renew, or extend contracts directly with listed companies or companies they control. Starting June 30, 2027, it also reaches contracts for goods or services incorporating goods or services those companies produce or develop (DoD Industrial Base Policy, Section 805). Section 805 has exceptions and a waiver route. Its contracting restrictions apply to the Defense Department. Section 889 applies across the federal government.

Download the full parsed 1260H list below if you need every name.

What does Section 889 ban? Part A vs. Part B

Section 889 has two parts. Part A, in force since Aug. 13, 2019, stops agencies from buying equipment, systems, or services that use covered gear as a substantial or essential component, or as critical technology in a system. Part B, in force since Aug. 13, 2020, stops agencies from contracting with a company that uses such a system, even in work that has nothing to do with the government. Both parts have exceptions and a waiver route.

Source: FAR 52.204-25(b), (e); FAR 52.240-91(d), (j), model deviation; FAR 40.205, deviation; GAO-26-108630, Table 1. Checked Sept. 29, 2026.

Here's what Part B means at a small shop. Say a machine shop sells bolts to the Army and runs Dahua cameras in its front office. The cameras never see an Army drawing. Part B still asks whether the shop uses covered gear anywhere in its business. That's the question its annual SAM.gov answer has to cover.

Two more details that matter. "Substantial or essential component" means any part the equipment or system needs to work properly. And the defined "reasonable inquiry" looks at information in your possession and does not require an internal or third-party audit (FAR 52.204-25(a)).

Do federal grants follow the same Section 889 rule?

Not the same way. The grant rule, 2 CFR 200.216, stops recipients and subrecipients from spending loan or grant money to buy covered gear or to sign contracts for it. It doesn't copy the contract rule's Part B test about everything a company uses.

The grant rule uses the same five names and the same four-part definition. It also says that when you accept a grant, you're certifying you'll comply (2 CFR 200.216, current to Sept. 25, 2026).

Source: 2 CFR 200.216; FAR 52.204-25; FAR Overhaul Part 40. Checked Sept. 29, 2026.

What are the two exceptions to Section 889?

Section 889 does not bar two things: (1) a service that connects to a third party's facilities, such as backhaul, roaming, or interconnection arrangements; and (2) telecom equipment that cannot route or redirect user data or see the data it handles. Both the standing clause and the FAR overhaul clause list the same two.

In plain terms, the first covers the specified third-party connection service, such as a carrier's roaming arrangement. It does not clear every device attached to that service. The second turns on what the equipment can do, not who owns it or whether it is online. Use the exact equipment test in your clause: “cannot route or redirect user data traffic or permit visibility into any user data or packets that such equipment transmits or otherwise handles” in FAR 52.204-25(c)(2).

Neither exception says "offline gear is fine" or "gear on non-government work is fine." Those aren't in the text (FAR 52.204-25(c); model FAR 52.240-91(b)(3), (d)(1)(ii)).

Which FAR clause applies, and how fast must you report?

It depends on the clause in your contract. The standing clause, FAR 52.204-25, gives you 1 business day after its specified identification or notification, and 10 business days after the first report for follow-up. The FAR overhaul model clause, 52.240-91, gives you 72 hours after its specified noncompliance trigger. A June 23, 2026 proposal would renumber the rules again, but it isn't final.

Why two versions at once? The Revolutionary FAR Overhaul is moving security rules into FAR Part 40. Agencies adopt it by "class deviation," one agency at a time. GSA's took effect Nov. 3, 2025. The Defense Department's took effect Feb. 1, 2026. By July 2026, 29 departments and agencies had issued one (GAO-26-108630). So one company can hold contracts under both versions.

Source: FAR 52.204-25; the Acquisition.gov model FAR 52.240-91(h), (j); FAR Overhaul Part 52; GAO-26-108630, footnote 21; Federal Register 2026-12559. Checked Sept. 29, 2026.

The clocks don't line up. If the reporting trigger occurs on a Tuesday, 1 business day lands on Wednesday while 72 hours lands on Friday. With a Friday trigger, both can land on Monday. Those examples assume no federal holiday or clock change; 72 hours means elapsed hours, not three business days. Read your contract to know which one you're on.

Two other changes are worth knowing. Under the FAR overhaul provision, submitting an offer counts as your Section 889 representation, instead of checking a box. And the June 2026 proposal, proposed 52.240-3(d)(1), says commercial sales, maintenance, testing, warranty services, and employees' use of personal equipment would not individually count as “use” for that specific prohibition. That is proposed text, not a blanket exception in every current contract. That proposal also carries the governmentwide CUI rule; see our coverage of the proposed FAR CUI rule in the same Part 40 package.

The prescribed subcontract flowdown omits the Part B use ban (see Table 5); a separate term in your subcontract still needs its own review. If you're a sub, your prime may also send Cybersecurity Maturity Model Certification (CMMC) terms at the same time. Our guide to CMMC for subcontractors and our CMMC flowdown checklist cover that separate rule.

How many federal contractors say they use covered equipment?

About 1,800. That's roughly 2% of companies with federal contract activity in fiscal year 2025, based on their SAM.gov answers as of March 2026. Almost 90% said they don't use covered equipment, and those companies received more than 98% of fiscal 2025 contract obligations (GAO-26-108630).

GAO's September 2026 report shows how Section 889 works in practice. Here are its numbers in one place.

Source: GAO-26-108630, published Sept. 22, 2026. Figures credited to GSA officials are as GSA reported them to GAO. Checked Sept. 29, 2026.

The $150 billion is spending in codes the waiver could cover—not spending shown to require a waiver. GAO could not determine exactly how many procurements needed it. The 102 comments are the set GAO analyzed: 106 submitted minus 3 withdrawn and 1 duplicate. The company population includes prime contracts, other transaction agreements, and reported subcontracts; the SAM percentages are not a product-audit result.

Contracting officers mostly take these answers at face value. GAO found GSA and Defense Department officers don't regularly check representations unless they have a reason to doubt one. Officials told GAO the False Claims Act, with penalties for each false claim, is a useful deterrent. Our cyber False Claims Act settlements tracker follows how that law is being used for cybersecurity promises.

What other federal "banned vendor" lists are not Section 889?

This reference compares eight other federal rules or lists, from Kaspersky and TikTok to drones and Chinese chipmakers. Each has its own law, its own list, and its own start date. The FCC Covered List includes all five expressly named Section 889 companies. A separate Defense Department clause, DFARS 252.204-7018, expressly names two of them, Huawei and ZTE.

Under the FAR overhaul, eight prohibitions are grouped in the model clause, 52.240-91: TikTok, Kaspersky, drones, Section 889, supply chain exclusion orders, Treasury sanctions, Sudan, and Iran (FAR 40.202, deviation). The table below adds the rules that live elsewhere.

*These counts describe different things: expressly named manufacturers, an editorially parsed notice, or equipment/service rows. They are not comparable list sizes and must not be added together. 'List-based' does not mean zero covered entities. The CSV states each count's basis. Primary sources are linked in each row; checked Sept. 29, 2026.

One row needs a flag. The FCC Covered List includes all five Section 889 companies, but it's a different tool. It supports separate equipment-authorization and FCC funding restrictions. The June 26, 2026 notice adopted import and marketing limits for specified previously authorized equipment added in 2024 or earlier; it set the general start at 10 days after Federal Register publication. The FCC's dated list also preserves use-based limits and states an October 13, 2026 start for the critical-infrastructure-surveillance portion. The notice does not itself ban continued use of equipment legally purchased with an existing authorization. None of that replaces the separate Section 889 contract test.

What does "NDAA compliant" mean for cameras?

It's a seller's claim, not a government certificate. The claim should identify the product, its maker and relevant components, and the Section 889 scope it addresses. Section 889 sets a ban; it doesn't set up any product certification.

So how do you test the claim? Ask two questions. Who actually made the camera or recorder? And who made its key parts? Then check the maker against the linked-firm list above. Remember the 2-in-5 trap: Hikvision reported EZVIZ and Hikmicro names in the 2025 FCC appendix, and neither name contains "Hikvision."

Purpose matters for these three makers. Section 889 covers Hikvision, Dahua, and Hytera gear used for public safety, government-facility security, critical-infrastructure surveillance, and other national security purposes. For a contractor, Part B looks at gear used anywhere in the business, so the purpose question can come up in places you might not expect, like a front-office camera. When in doubt, get the contracting officer's answer in writing.

If your contract also requires CMMC, cameras protecting controlled-data areas can raise a separate physical-security question. See our guide to CMMC physical security requirements. Passing one doesn't pass the other.

How do you check a vendor against Section 889?

Start with three checks: the vendor's Section 889 answer in the System for Award Management (SAM.gov), the maker of the actual product, and the maker's name against the 146 reported names above. A clean result on all three still isn't a guarantee. These dated sources do not establish the full set of entities the law can cover.

1. Look up the vendor's representation. GSA's free 889 Representations Search shows whether a company has a Section 889 answer in SAM.gov. It only covers registered companies, and some records are hidden from public view.
2. Find the real maker. A reseller's label isn't the maker. Get the brand, model number, and manufacturer part number. Those are the same details the FAR clause asks you to report.
3. Check the maker's name. Search the full tables above or the CSVs. Search the full legal name and the brand.
4. Check SAM.gov exclusions. The FAR overhaul text says known subsidiaries and affiliates are recorded there.
5. Write it down. The rule asks for a reasonable inquiry of what you already know, not an audit. A dated record shows what you checked and when.

Most of this work starts with knowing what you own. Our CMMC asset inventory guide shows how to build that list. Its categories answer CMMC questions, not Section 889, but the same inventory feeds both.

If a prime's supplier form asked about Section 889 and CMMC on the same page, Find My CMMC Path is our free tool for sorting out the CMMC half.

What changed, and when?

Section 889's five names haven't changed since 2018. The rules around them have changed: agency clause versions, reporting clocks, the FCC list, and restrictions tied to a separate Pentagon list. Here's the timeline.

Source: as listed in each row; links in the source list below. Checked Sept. 29, 2026.

How we built this

We read the primary documents and counted. For the linked-firm list, we transcribed and checked the names in both appendices of the FCC's October 2025 advisory. We lowercased each name and removed characters other than a-z and 0-9 for matching. We removed two Dahua duplicates and set aside Huawei's own formal name: 20 Appendix A names + 129 Appendix B names − 2 duplicates − 1 formal-name row = 146 other reported names. For the brand-name finding, we tested each name for its own parent brand string with the same normalization: 59 ÷ 146 = 40.4%, rounded to 40%. Dahua's share is 130 ÷ 146 = 89.04%, rounded to 89%.

For the 1260H list, we counted each parent listing in the June 10, 2026 Federal Register notice as one entity and each subsidiary named inside it as one more. For the clause table, we read the codified FAR provisions and the base 52.240-90 and 52.240-91 models on Acquisition.gov, then checked the separately proposed 52.240-2 and 52.240-3 against the June 23, 2026 Federal Register document. For the GAO figures, we took each number as GAO reported it, with GAO's own date. The source and arithmetic checks in this audit were made on Sept. 29, 2026. Original observation dates stay separate from that check date. The 1260H total uses the documented COMAC name split; aliases and former names are not extra entities. The sources can support a dated name record without proving current ownership or the status of a product.

Anyone can repeat this. Open FCC DA 25-927, list the names in both appendices, and follow the steps above. Every row in our downloads carries its source link and check date. This is a document review, not a survey, product test, or legal opinion.

What this data does and doesn't show

It shows what the five companies told the FCC, what the Defense Department published, and what GAO reported. It does not show every subsidiary or affiliate: the FCC says its appendices aren't complete, and GSA's underlying list of about 700 was not available to this review; GAO says it was not broadly shared with other federal agencies. It doesn't say which products are covered, and it doesn't clear any company that isn't on it.

Names can mislead. The 1260H list includes "Chengdu Dahua Wisdom Information Technology Co., Ltd." Dahua's FCC filing includes "Chengdu Dahua Smart Information Technology Co., Ltd." Those may be the same company translated two ways, or two companies. We didn't treat them as a match. Company lists also go stale; ours are dated so you can tell how old they are.

This page is educational. It isn't legal advice. For a decision about a specific contract or purchase, take your facts to the contracting officer or a lawyer.

How to cite this page

Cite the finding you use, with its check date. Here's a ready-to-copy version:

The Defense Compliance Report Editorial Team. "NDAA Section 889 Banned List: The 5 Companies and 146 Reported Names." The Defense Compliance Report, sources checked September 29, 2026; FCC lists as of September 22 and October 10, 2025. https://thedefensecompliancereport.com/research/ndaa-section-889-banned-list/

For a single name, cite its row anchor and original list date, not just this page's check date. The full tables supply permanent row links. For GAO's figures, also name GAO-26-108630 as the original source.

Reuse: You may reuse our original counts, compilation, and charts with credit to The Defense Compliance Report; keep the attribution and any applicable terms for underlying sources and company-submitted material. No link is required.

Download the data

Five free CSV files, no sign-up. Every row has its source link and check date.

• section-889-named-companies-and-linked-firms.csv: the 5 named companies, all 146 reported linked-firm names, and 1 formal-name row (152 rows)
• dod-1260h-list-2026-06-10.csv: the June 10, 2026 1260H list, parsed (80 parent rows, 188 entities)
• federal-covered-vendor-crosswalk.csv: 9 federal covered-vendor rules compared
• section-889-clause-and-reporting-crosswalk.csv: 7 Section 889 clauses and their reporting clocks
• section-889-gao-2026-figures.csv: 12 figures from GAO-26-108630

Frequently asked questions

Is Section 889 still in effect?

Yes. The standing FAR clause, 52.204-25, is still in the FAR, and the FAR overhaul clause, 52.240-91, carries the same two bans. GAO reported in September 2026 that the interim rules from 2019 and 2020 are still in place while final rules are pending. A proposed rewrite doesn't repeal the law. Source 1 · Source 2

Which companies are on the NDAA Section 889 banned list?

Five: Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company. Their subsidiaries and affiliates are covered too. The 2025 FCC appendices contain 146 other reported names after our de-duplication, listed above. Source 1 · Source 2

What does "NDAA Section 889 compliant" mean?

For a contractor, it means you don't sell covered gear to the government (Part A) and, after a reasonable inquiry, don't use it anywhere in your business (Part B), unless an exception or waiver applies. For a product, it's a seller's claim. Section 889 itself doesn't set up any product certification. Source

What are the two exceptions to Section 889?

Services that connect to a third party's facilities, such as backhaul, roaming, or interconnection, and telecom equipment that can't route or redirect user data or see the data it handles. "Offline" and "not used on government work" are not exceptions. Source 1 · Source 2

Is Hikvision on the Section 889 list?

Yes. Hangzhou Hikvision Digital Technology Company is named in the law, for video surveillance and telecom gear used for security purposes. The October 2025 FCC appendix lists 9 names reported by Hikvision, including Hikvision USA, two EZVIZ entities, Hikmicro, and Hikrobot. Source 1 · Source 2

Is there an official Section 889 form?

No single federal form. Contractors answer in SAM.gov under FAR 52.204-26 or in their offer under 52.204-24. Under the FAR overhaul provision, submitting an offer counts as the representation. For vendors not registered in SAM.gov, Defense Department purchase-card holders must get a representation directly, GAO reports. Source 1 · Source 2 · Source 3

Is the 1260H list the same as the Section 889 list?

No. Our parsing of the June 10, 2026 1260H notice counts 188 entities under a different law. Section 805 separately attaches DoD contracting restrictions to listed or controlled entities. The notice expressly names Huawei, Hikvision, and Dahua, but not ZTE or Hytera; that is not a product-clearance test. Source 1 · Source 2

Does Section 889 apply to federal grants?

Yes, through 2 CFR 200.216. Recipients and subrecipients can't spend loan or grant money on covered gear or on contracts for it. That rule doesn't copy the contract rule's Part B test on everything a company uses. Source

Can you get a waiver from Section 889?

The original two-year agency-head waiver windows have ended; section 889(d)(2) separately allows the Director of National Intelligence to waive a prohibition for national-security reasons. Agency heads could grant waivers for just two years after each part took effect. GAO reported that the Defense Department relies on a waiver covering hundreds of product and service codes for overseas and low-risk buys; about $150 billion of its fiscal 2025 contract obligations fell under those codes. That is not the amount shown to require a waiver. Source 1 · Source 2

How fast do I have to report covered equipment I find?

Under FAR 52.204-25(d), within 1 business day of the specified identification or notification; follow-up is within 10 business days after the first report. Under model 52.240-91(h), the initial clock is 72 hours from its noncompliance trigger, with newly discovered required information due within 72 hours of discovery. Your contract decides which applies. Source 1 · Source 2

Sources

All sources checked Sept. 29, 2026.

1. Federal Communications Commission. National Security Advisory No. 2025-01, DA 25-927, released Oct. 14, 2025 (Appendix A as of Oct. 10, 2025; Appendix B as of Sept. 22, 2025).
2. U.S. Government Accountability Office. GAO-26-108630, Telecommunications: Better Information Sharing Needed to Ensure Compliance with Foreign-Sourced Equipment Prohibitions, Sept. 22, 2026.
3. FAR 52.204-25, Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment (Nov. 2021), Acquisition.gov.
4. FAR 52.204-24 and FAR 52.204-26, Section 889 representations, Acquisition.gov.
5. FAR Overhaul, Part 40 (deviation text), Acquisition.gov, model text checked Sept. 29, 2026.
6. FAR Overhaul, Part 52 (deviation text), including base model 52.240-90 and 52.240-91 (headings use “Deviation Date”), Acquisition.gov.
7. 2 CFR 200.216, eCFR, current to Sept. 25, 2026.
8. Department of Defense. Notice of Availability of Designation of Chinese Military Companies, 91 FR 35189, June 10, 2026.
9. Department of Defense, Industrial Base Policy. NDAA Section 805 Inquiries.
10. Federal Communications Commission. Covered List, updated Sept. 18, 2026.
11. DFARS 252.204-7018, Prohibition on the Acquisition of Covered Defense Telecommunications Equipment or Services (Jan. 2023).
12. Federal Register 2026-12559, FAR overhaul proposed rule (FAR Case 2026-001), June 23, 2026.
13. Federal Register 2026-03065, Prohibition on Certain Semiconductor Products and Services (proposed), Feb. 17, 2026.
14. FAR 52.240-1, drone prohibition, Acquisition.gov; and SAM.gov, American Security Drone Act-Covered Foreign Entity List (updated Nov. 13, 2024).
15. GSA SmartPay. 889 Representations Search.
16. Acquisition.gov. Section 889 Policies.
17. Public Law 115-232, John S. McCain National Defense Authorization Act for Fiscal Year 2019, section 889.

1. Federal Communications Commission. DA 26-635, June 26, 2026, adopted import/marketing prohibitions for specified previously authorized covered equipment; implementation section sets the general Federal Register publication trigger.
2. U.S. Court of Appeals for the Fifth Circuit. Huawei Technologies Company, Limited v. FCC, No. 19-60896, June 18, 2021, caption and introduction; identity support only, not a current corporate-ownership finding.
3. COMAC. Company profile, identifying its America Corporation separately from its Design and Research Center; supports the documented parsing of the June 2026 notice.
4. Acquisition.gov. FAR 52.204-23, Kaspersky prohibition, and FAR 52.204-27, ByteDance covered-application prohibition.
5. Acquisition.gov. FAR 52.204-30, FASCSA orders; SAM.gov orders page. The landing page was checked; the active order download was not retrieved, so this page makes no current order-specific finding.
6. GAO. GAO-26-108630 recommendation tracker, four recommendations marked open when checked Sept. 29, 2026.

The Defense Compliance Report Research is the research and reference section of thedefensecompliancereport.com.