```html

Section 889 Compliance in Supply Chain: Tier-2 Subcontractor Risk Assessment

Introduction: Why Tier-2 Risk Is the New Compliance Frontier

Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (NDAA FY2019) prohibits federal agencies and their contractors from procuring, using, or extending or renewing contracts with entities that use telecommunications equipment or services produced by five specifically named Chinese entities: Huawei Technologies, ZTE Corporation, Hytera Communications, Hangzhou Hikvision Digital Technology, and Dahua Technology, along with their subsidiaries and affiliates. Part A of the rule, effective August 13, 2019, addressed direct agency procurement. Part B, effective August 13, 2020, extended the prohibition to contractors' internal use of covered equipment anywhere in their own operations—regardless of whether that equipment is used in the performance of a federal contract.

For network engineers and IT procurement teams supporting federal, military, or education customers, the compliance challenge has evolved well beyond simply avoiding a blacklisted brand on a purchase order. The critical vulnerability now lives in the Tier-2 subcontractor layer—the component suppliers, ODM manufacturers, and cable assembly houses that feed the branded products on your approved vendor lists. This guide provides a structured methodology for assessing that risk, with grounding in the physical-layer standards that define compliant structured cabling infrastructure.

Understanding the Tier-2 Problem in Physical Layer Infrastructure

Physical-layer cabling infrastructure—copper, fiber, and connectivity hardware—is often perceived as inherently inert from a cybersecurity and compliance standpoint. This perception is dangerously incomplete. Passive infrastructure components such as patch panels, cable assemblies, and fiber transceivers increasingly incorporate embedded firmware, RFID tracking chips, or optical monitoring microcontrollers. When a Tier-1 branded product sources these subcomponents from a manufacturer with ties to a Section 889-covered entity, the entire assembly may be rendered non-compliant, even if the top-level brand is itself not prohibited.

"The supply chain risk for telecommunications infrastructure is not limited to the system integrator or the named brand. Compliance programs that do not reach back to the component and subassembly level are incomplete by definition. Contracting officers are increasingly requesting country-of-origin attestations at the bill-of-materials level, not just the finished-goods level."

The FAR Council's implementing rule, codified at FAR 52.204-25, requires contractors to represent that they do not and will not use covered telecommunications equipment or services in performance of a contract. Critically, "use" is defined broadly to include equipment used in a contractor's own network infrastructure, creating direct exposure at the physical layer.

Physical Layer Standards as a Compliance Anchor

Grounding your Tier-2 risk assessment in recognized cabling standards creates an auditable technical baseline. Key standards that define compliant infrastructure include:

• TIA-568.2-D — Defines performance requirements for balanced twisted-pair telecommunications cabling, including Cat6A channel insertion loss limits of ≤20.9 dB at 500 MHz and return loss minimums of ≥18.0 dB at 500 MHz. Components certified to this standard must be tested and documented by traceable manufacturers.
• ANSI/TIA-942-B — The data center telecommunications infrastructure standard, which mandates documentation of all structured cabling pathways, spaces, and components, providing the audit trail needed for Section 889 attestations.
• ISO/IEC 11801-1:2017 — The international generic cabling standard; Class EA permanent link attenuation limits of ≤18.0 dB at 500 MHz align with TIA-568.2-D for Cat6A, enabling cross-reference during multi-standard federal audits.
• IEEE 802.3bt (PoE++): — Supports up to 90W power delivery over 4-pair cabling; copper cabling components used in PoE applications must meet conductor resistance unbalance specifications of ≤3% per TIA-568.2-D to avoid thermal compliance failures that could mask substandard ODM sourcing.
• NEC Article 800 — Governs listed communications cables; listings require manufacturer traceability to a nationally recognized testing laboratory (NRTL), which provides one layer of country-of-origin documentation for cable constructions.

For fiber optic infrastructure, OM4 multimode fiber per ISO/IEC 11801 supports a minimum modal bandwidth of 4700 MHz·km at 850 nm and a maximum channel attenuation of 3.5 dB for a 100 m OM4 link at 850 nm under IEEE 802.3ae specifications. OM5 fiber extends this to wideband multimode applications from 850 nm to 953 nm per TIA-492AAAE. Fiber transceivers sourced from ODMs in non-compliant supply chains represent a high-risk Tier-2 node because they contain active components with embedded firmware.

Tier-2 Risk Assessment Framework

A structured Tier-2 subcontractor risk assessment for Section 889 should proceed through four phases:

• Phase 1 — Bill of Materials (BOM) Decomposition: Require Tier-1 vendors to provide full component-level BOMs, including subcontractor identities for transceivers, RJ45/LC connectors, patch panel port modules, cable jacket compounds, and any embedded electronics. Cross-reference against the SAM.gov exclusions list and the FCC's Covered List under the Secure and Trusted Communications Networks Act.
• Phase 2 — Country-of-Origin Mapping: Map each BOM component to its country of manufacture. Note that COTS cable assemblies meeting TIA-568.2-D may be manufactured globally; the critical compliance determination is whether any subcomponent originates from a covered entity, not merely from a covered country.
• Phase 3 — Attestation and Documentation: Collect written Tier-2 supplier attestations under FAR 52.204-25 language. For BABA-compliant procurements under the Infrastructure Investment and Jobs Act, additionally require documentation supporting the 55% domestic content threshold for iron, steel, manufactured products, and construction materials.
• Phase 4 — Ongoing Monitoring: Section 889 covered entity lists are subject to expansion via FCC and DoD action. Implement a quarterly review cycle against updated covered lists, particularly for transceiver and active component suppliers where ODM consolidation is frequent.

Compliance Risk Comparison: Passive vs. Active Physical Layer Components

Component Category	Section 889 Tier-2 Risk Level	Key Standards Reference	Primary Compliance Exposure	Recommended Mitigation
Bulk Copper Cable (Cat6A)	Low–Medium	TIA-568.2-D, NEC Article 800	ODM jacket/conductor sourcing	NRTL listing + COFS declaration
Fiber Optic Transceivers (SFP/QSFP)	High	IEEE 802.3ae/802.3ba, TIA-492AAAE	Embedded firmware, ODM chip sourcing	Full BOM + firmware version attestation
Patch Panels / Keystone Jacks	Low	TIA-568.2-D, ISO/IEC 11801-1	Embedded RFID/asset tracking chips	Confirm passive-only construction
Fiber Optic Cable (OM4/OM5)	Low	ISO/IEC 11801, TIA-492AAAD/E	ODM preform/draw sourcing	Manufacturer origin disclosure
UPS / PDU (Data Center Power)	High	ANSI/TIA-942-B, UL 1778	Network management card firmware	NMC firmware audit + covered entity check
Cable Management Hardware	Very Low	ANSI/TIA-942-B, NEC Article 800	Minimal; purely mechanical	Country-of-origin for BABA compliance

Contractual Flow-Down Requirements

FAR 52.204-25 must be flowed down to subcontractors at all tiers when the prime contract includes this clause. Procurement teams should ensure that all purchase orders for telecommunications infrastructure components include the following contractual provisions:

• An explicit representation that the supplier does not use covered telecommunications equipment in its own operations or in the manufacture of the supplied goods.
• A requirement to notify the prime within five business days of discovering any covered equipment in the supply chain.
• A right-to-audit clause permitting inspection of subcontractor BOMs and country-of-origin documentation upon request.

"Effective supply chain risk management for federal telecommunications infrastructure requires treating the BOM as a compliance document, not merely a technical one. Every passive and active component that touches a government network—from the fiber preform to the SFP transceiver—represents a potential point of non-conformance under current statutory requirements."

Practical Steps for Procurement Teams

Network engineers and IT procurement professionals supporting government or federally-funded projects should operationalize Section 889 Tier-2 compliance through the following immediate actions:

• Audit all active infrastructure contracts for FAR 52.204