Category: Laws & Executive Orders

Section 889 Prohibition

Also known as: Section 889 of the FY19 NDAA, Section 889(a)(1)(A) and (a)(1)(B) prohibitions, FAR 52.204-25 prohibition

Simply put

The Section 889 Prohibition is a federal contracting rule, drawn from Section 889 of the Fiscal Year 2019 National Defense Authorization Act (NDAA), that restricts the government from buying or using certain covered telecommunications and video surveillance equipment and services. It aims to protect national security by limiting the government's exposure to these covered products and providers. Contractors must generally represent whether they provide or use such covered equipment or services when doing business with federal agencies.

Formal definition

Section 889 of the FY19 NDAA established two related prohibitions implemented in the Federal Acquisition Regulation (FAR), principally at FAR 52.204-25. Section 889(a)(1)(A) prohibits federal agencies from procuring, obtaining, or extending or renewing a contract to procure or obtain any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component or as critical technology. Section 889(a)(1)(B), effective August 13, 2020, prohibits agencies from contracting with entities that use such covered telecommunications and video surveillance equipment or services. Under FAR 52.204-25, the contractor is prohibited from providing to the Government any equipment, system, or service that uses covered telecommunications equipment or services subject to the rule's defined terms. The specific covered entities, effective dates, waiver provisions, and representation and reporting mechanics are governed by the applicable NDAA text and FAR provisions as amended; readers should verify the current authoritative text, and note that this entry does not address contract-specific implementation, waiver eligibility, or legal determinations, which must be confirmed against official sources.

Why it matters

The Section 889 Prohibition represents one of the federal government's most significant supply chain security measures, reflecting a policy determination that certain covered telecommunications and video surveillance equipment and services pose risks that warrant restricting their presence in government procurement and use. For contractors, the prohibition reshapes not only what they may sell to the government but, under Section 889(a)(1)(B) effective August 13, 2020, whether they may contract with the government at all if they use such covered equipment or services in their own operations. This second prohibition extends the compliance obligation beyond the specific goods delivered under a contract and into a contractor's broader enterprise, which is why it draws substantial attention from compliance officers and acquisition professionals.

The practical stakes are high because the prohibition affects eligibility to do business with the federal government, not merely the technical merits of a given product. A contractor that provides or uses covered equipment or services, subject to the rule's defined terms, may be barred from award or from continuing a contract. It is important to distinguish this acquisition-based prohibition from broader information security frameworks: compliance with Section 889 addresses a specific statutory supply chain restriction and is not a substitute for, nor is it satisfied by, meeting other cybersecurity or authorization requirements. Contractors should also recognize that the specific covered entities, effective dates, and waiver provisions are governed by the applicable NDAA text and FAR provisions as amended, so eligibility determinations must be confirmed against current authoritative sources rather than assumed.

Who it's relevant to

Government Contractors and Subcontractors

Entities that sell to or contract with federal agencies are directly subject to the prohibition, including the (a)(1)(B) restriction on contracting with entities that use covered equipment or services in their own operations. Contractors generally must be prepared to represent whether they provide or use such covered equipment or services, and should verify the current FAR provisions and covered-entity definitions rather than relying on prior understandings.

Acquisition and Contracting Professionals

Contracting officers and acquisition staff apply the Section 889 restrictions during procurement, award, and the extension or renewal of contracts. They must account for both the (a)(1)(A) prohibition on procuring covered equipment or services and the (a)(1)(B) prohibition on contracting with entities that use them, and confirm the applicable effective dates and waiver mechanics against current FAR and NDAA text.

Compliance and Supply Chain Risk Officers

Personnel responsible for supply chain risk management and regulatory compliance must assess whether their organization provides or uses covered telecommunications or video surveillance equipment or services. They should treat Section 889 as a distinct statutory acquisition restriction that is separate from, and not satisfied by, other cybersecurity or authorization requirements.

Federal Agency Officials

Agency officials responsible for procurement decisions are prohibited under Section 889 from procuring or obtaining covered equipment or services and, under (a)(1)(B), from contracting with entities that use them. These officials should reference the governing NDAA and FAR text and any applicable waiver provisions when making determinations.

Inside Section 889 Prohibition

Part A Prohibition (Use of Covered Equipment)

Generally prohibits executive agencies from procuring or obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses covered telecommunications equipment or services as a substantial or essential component, or as critical technology. Readers should verify the current statutory and FAR text for the exact scope.

Part B Prohibition (Entities That Use Covered Equipment)

Generally prohibits agencies from contracting with an entity that uses covered telecommunications equipment or services, regardless of whether that use is connected to the government contract. This broader prohibition typically requires the contractor to assess its own systems, and its scope should be confirmed against the applicable regulatory implementation.

Covered Telecommunications Equipment or Services

Refers to the specific categories of equipment and services identified in the statute, which have been associated with named companies and their subsidiaries and affiliates. The precise list and any named entities should be verified against the current authoritative text rather than assumed.

Implementing Regulation (FAR)

The prohibition is implemented for federal acquisitions through the Federal Acquisition Regulation, including associated solicitation provisions and contract clauses and representation requirements. Practitioners should confirm the specific FAR provisions and clause numbers currently in effect, as these can be revised.

Representations and Reporting Obligations

Offerors and contractors are generally required to make representations regarding covered equipment or services and to report discovery of such equipment or services during contract performance within the timeframes established by the applicable clause. Exact reporting mechanics and deadlines should be verified against current guidance.

Waiver and Exception Mechanisms

The statute and its implementation provide for limited waivers and exceptions under specified conditions and approval authorities. The availability, duration, and approving officials for any waiver should be confirmed against current authoritative sources, as these are constrained and not open-ended.

Common questions

Answers to the questions practitioners most commonly ask about Section 889 Prohibition.

Does removing prohibited equipment from a single contract's deliverables satisfy Section 889?

Not necessarily. The prohibition is generally understood to reach beyond what a contractor delivers to the government. Part B, in particular, is commonly interpreted to address the contractor's own use of covered telecommunications equipment or services, which can extend to systems not directly tied to the specific contract. Scoping the prohibition only to contract deliverables is a common error. Contractors should confirm the applicable scope of both Part A and Part B against the current regulatory text and their contracting officer's guidance rather than assuming a deliverable-only reading.

If a company completed its Section 889 representation once, is it covered for all future work?

Generally no. Representations are tied to the applicable acquisition and reporting framework rather than serving as a permanent, one-time clearance. Treating a prior representation as a lasting exemption is a frequent misconception. Circumstances, product inventories, and supply chains can change, and the representation obligations are recurring in nature. Contractors should verify current representation and reporting requirements for each applicable solicitation and confirm timing and frequency against the authoritative acquisition regulation text.

How should a contractor identify whether it uses covered telecommunications equipment or services?

In most implementations this involves a reasonable inquiry into the equipment and services in use, which may include inventorying hardware, software, and telecommunications or video surveillance services, and reviewing supplier and subcontractor sources. The appropriate depth of inquiry can vary by organization. This entry does not prescribe a specific methodology; contractors should confirm expectations for the scope and rigor of the inquiry against current guidance and, where applicable, with their contracting officer.

What are the reporting expectations if prohibited equipment or services are discovered during performance?

The prohibition framework generally contemplates reporting obligations when covered telecommunications equipment or services are identified. The specific timelines, content, and recipients of any required report are governed by the applicable regulatory provisions and contract terms. This entry does not state those specifics; contractors should verify the current reporting requirements, including any deadlines, against the authoritative text and their contract.

Can a contractor obtain relief from the prohibition through a waiver?

The statutory and regulatory framework has, in general terms, contemplated limited waiver or exception mechanisms, but their availability, scope, and duration are governed by the applicable authorities and are subject to change. A waiver should not be assumed to be broadly available or automatically granted. Contractors should confirm whether any waiver or exception applies to their situation, and the process for it, against current official sources and with the responsible agency.

How does Section 889 interact with subcontractors and the broader supply chain?

The prohibition is commonly understood to have implications that extend into supplier and subcontractor relationships, which is why supply chain inquiry is often part of compliance efforts. The precise flow-down and subcontractor obligations depend on the applicable clauses and contract terms. This entry does not resolve those contractual specifics; contractors should review the governing clause language and confirm flow-down requirements against the current authoritative text and their contracting officer's direction.

Common misconceptions

Section 889 only restricts equipment purchased for or used on a specific government contract.

Part B generally reaches an entity's use of covered telecommunications equipment or services regardless of whether that use relates to a particular government contract. This makes the assessment an enterprise-wide obligation in most implementations rather than a contract-specific one. Confirm the precise scope against the current regulatory text.

Section 889 is a cybersecurity control framework comparable to NIST SP 800-171 or the RMF.

Section 889 is a statutory procurement prohibition implemented through the FAR, not a security control baseline. It is distinct from, and does not substitute for, obligations such as NIST SP 800-171 safeguarding of CUI, DFARS clause requirements, or RMF authorization activities. Compliance with one does not establish compliance with another.

Submitting a representation that the entity does not use covered equipment fully discharges the contractor's obligation.

Representations are a point-in-time attestation. Contractors generally have ongoing obligations, including reporting the discovery of covered equipment or services during performance, and treating the representation as a one-time checkbox rather than a continuing duty is a common error. Verify current reporting requirements in the applicable clause.

Best practices

Conduct an enterprise-wide inventory of telecommunications and video surveillance equipment and services to support both the Part A and Part B analyses, rather than limiting review to items tied to a single contract.

Verify the current statutory language and the specific implementing FAR provisions and clause numbers before relying on any summary, since procurement regulations are revised over time.

Establish supply chain and subcontractor due diligence processes so that representations reflect components sourced through lower tiers, and document the basis for each representation.

Maintain a defined procedure for identifying and reporting discovery of covered equipment or services during contract performance within the timeframe required by the applicable clause.

Confirm whether a waiver or exception is available, who the approving authority is, and its duration through current authoritative sources before assuming any relief from the prohibition.

Coordinate Section 889 compliance with, but keep it distinct from, other obligations such as NIST SP 800-171, DFARS requirements, and RMF activities, and consult counsel and current official guidance for contractual and legal specifics.