Telecommunications Act Section 889: Prohibited Equipment in Federal Networks
Overview and Legislative Context
Section 889 of the John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year 2019 (Public Law 115-232) prohibits federal agencies and their contractors from procuring, obtaining, or extending contracts with entities that use certain telecommunications equipment and services deemed to pose national security risks. The statute targets equipment manufactured by a defined list of Chinese-origin companies, including Huawei Technologies, ZTE Corporation, Hytera Communications, Hangzhou Hikvision Digital Technology, and Dahua Technology, along with their subsidiaries and affiliates. Compliance is not optional — it is a binding condition of federal contracting and flows down to subcontractors and suppliers at all tiers.
The rule is implemented in two distinct parts. Part A, effective August 13, 2019, prohibits federal agencies from directly procuring covered equipment. Part B, effective August 13, 2020, extends the prohibition to any contractor or subcontractor that uses such equipment anywhere in their internal networks, even if that equipment is not itself delivered to the government. Together, these provisions represent one of the most expansive supply chain security mandates ever imposed on federal information and communications technology (ICT) infrastructure.
What Equipment Is Covered
The prohibition applies broadly to telecommunications equipment and services — routers, switches, IP cameras, video surveillance systems, network-attached storage devices, and any component substantially manufactured by a covered entity. Critically, passive structured cabling infrastructure (copper and fiber) is generally not in scope as "telecommunications equipment" under Section 889 when it lacks embedded intelligence from a covered manufacturer. However, active network components, transceivers with embedded firmware, and managed patch panels sourced from prohibited vendors fall squarely within the prohibition.
Federal procurement officers and network engineers must conduct thorough bills of materials (BOM) reviews and supplier declarations before accepting any active network component. The Federal Acquisition Regulation (FAR) clauses 52.204-24, 52.204-25, and 52.204-26 codify the representation and disclosure requirements contractors must satisfy.
"Supply chain risk management for federal telecommunications infrastructure requires traceability from the raw component level through finished system integration. Agencies cannot rely solely on vendor self-attestation; they must demand documentation that confirms country of origin, firmware provenance, and manufacturing lineage for every active element in the network path."
Structured Cabling Compliance: Building a Section 889-Safe Physical Layer
While passive cabling itself is not the primary target of Section 889, federal network architects must ensure the entire ICT ecosystem — including the physical layer — is sourced from manufacturers whose supply chains are fully documented and free of covered-entity involvement. Selecting cabling infrastructure that conforms to recognized standards ensures both technical performance and procurement defensibility.
Key physical layer standards governing federal and commercial structured cabling installations include:
- ANSI/TIA-568.2-D: The governing standard for balanced twisted-pair telecommunications cabling. It specifies permanent link channel performance for Cat5e (up to 100 MHz), Cat6 (up to 250 MHz), Cat6A (up to 500 MHz), and Cat8 (up to 2,000 MHz, supporting 40GBASE-T over 30 meters per IEEE 802.3bq).
- ANSI/TIA-942-B: The data center telecommunications infrastructure standard, which defines redundancy tiers (Tier I–IV) and cabling topology requirements for mission-critical government facilities.
- ISO/IEC 11801-1:2017: The international standard for generic cabling in customer premises, harmonized with TIA-568 for global interoperability in NATO and allied-nation joint facilities.
- NEC Article 800: Governs the installation of communications circuits in U.S. buildings, including fire-rating requirements (CMR, CMP plenum-rated) applicable to all federal facility cabling.
Fiber Optic Specifications for Secure Federal Deployments
Multimode and single-mode fiber remains the preferred backbone medium for secure federal and military facilities due to its immunity to electromagnetic interference and the difficulty of undetected physical tapping. Selecting the correct fiber grade is essential for both performance and standards compliance:
- OM3 (ISO/IEC 11801 designation): 50/125 µm laser-optimized multimode fiber; minimum modal bandwidth of 2,000 MHz·km (overfilled launch) and 2,000 MHz·km effective modal bandwidth (EMB). Supports 10GBASE-SR (IEEE 802.3ae) to 300 meters and 40GBASE-SR4 to 100 meters.
- OM4: Enhanced 50/125 µm; minimum EMB of 4,700 MHz·km. Extends 10GBASE-SR to 400 meters and supports 100GBASE-SR10 to 150 meters per IEEE 802.3ba.
- OM5 (ANSI/TIA-492AAAE): Wideband multimode fiber supporting shortwave wavelength division multiplexing (SWDM) from 850 nm to 953 nm; extends 100G capacity over existing multimode infrastructure.
- Single-mode OS2: 9/125 µm; insertion loss ≤0.4 dB/km at 1,310 nm and ≤0.3 dB/km at 1,550 nm per IEC 60793-2-50; used for inter-building and campus backbone in government campuses exceeding multimode distance limits.
"The physical layer is the foundation of network security. A well-documented, standards-compliant structured cabling system — with verified manufacturer provenance — reduces attack surface, simplifies audits, and supports the continuous monitoring demands of zero-trust architectures in federal environments."
Section 889 Compliance Comparison: Passive vs. Active Infrastructure
| Infrastructure Category | Section 889 Applicability | Key Standards | Recommended Verification Action |
|---|---|---|---|
| Copper patch cords & bulk cable (Cat6/Cat6A/Cat8) | Generally not covered (passive) | ANSI/TIA-568.2-D, NEC Article 800 | Confirm country of manufacture; retain BOM documentation |
| Fiber optic cable & connectors (OM3/OM4/OS2) | Generally not covered (passive) | ISO/IEC 11801, ANSI/TIA-568.3-D | Verify manufacturer is not a covered-entity subsidiary |
| Managed switches & routers | Fully covered — prohibited if from covered entity | IEEE 802.3, FAR 52.204-25 | Obtain signed Section 889 representation; verify firmware origin |
| IP cameras & video surveillance | Explicitly covered by name (Hikvision, Dahua) | FAR 52.204-25, NDAA FY2019 §889(f)(3) | Replace with non-covered-entity alternatives; document removal |
| Enclosures, racks & cable management (passive) | Not covered (no embedded intelligence) | ANSI/TIA-942-B, EIA-310-D | Standard vendor qualification; no Section 889 attestation required |
| UPS & PDU systems (intelligent/networked) | Covered if network management card runs prohibited firmware | ANSI/TIA-942-B, IEC 62040-3 | Confirm management card manufacturer; review embedded OS provenance |
Procurement Best Practices for Federal Contractors
Achieving Section 889 compliance requires a structured, repeatable procurement process rather than one-time attestation. Network engineers and IT procurement officers should implement the following controls:
- Tiered supplier representation: Require all suppliers to execute FAR 52.204-24 representations and update them annually or upon any supply chain change. Do not rely solely on manufacturer country-of-origin labeling.
- Component-level BOM review: For active equipment, demand a component-level bill of materials identifying chipset manufacturers, firmware developers, and sub-tier suppliers. Section 889 reaches subsidiaries and affiliates, not just top-level brand names.
- Leverage BABA-aligned sourcing: The Build America, Buy America Act (BABA, Infrastructure Investment and Jobs Act, 2021) reinforces domestic content requirements for federally funded infrastructure projects. Sourcing structured cabling and passive infrastructure from domestic or allied-nation manufacturers simultaneously satisfies BABA thresholds and reduces Section 889 exposure.
- Certification testing and documentation: All copper cabling installations in federal facilities should be certified to channel performance per ANSI/TIA-568.2-D using a qualified Level IIIe field tester (per TIA-1152-A). Fiber links should be OTDR-tested with results archived per ANSI/TIA-942-B requirements, maintaining insertion loss budgets (typically ≤3.5 dB for a 100-meter OM4 channel at 850 nm).
- GSA and contract vehicle alignment: When procuring through GSA Schedule 70 or other GWAC/IDIQ vehicles, confirm that the Schedule contractor's Section 889 representations are current and on file with the contracting officer.
Enforcement, Penalties, and Ongoing Risk
Non-compliance with Section 889 can