NDAA Section 889

Prohibits use of Huawei, ZTE, Hikvision, Dahua, Hytera equipment in federal contracts.


Short name	NDAA 889
Region	Americas
Country or scope	United States
Sector	Defense
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers NDAA 889

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for NDAA 889.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for NDAA 889 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`NDAA889-SUPPLIER` Supplier Screening Coverage	Screening for covered entities requires knowing the supplier of essentially every component or equipment item in use (NDAA FY2019 §889(a)(1); FAR 52.204-25)	Scan
`NDAA889-INV` Complete Equipment and Software Inventory	The prohibition on using covered equipment or services can only be honored with a complete inventory of components and equipment in use (NDAA FY2019 §889(a)(1)(B))	Scan
`NDAA889-IDENT` Component Identifiability	Determining whether an item is covered equipment requires unambiguous identification of components against the prohibited-entity lists (FAR 52.204-25 definitions of covered telecommunications equipment)	Scan
`NDAA889-COMPLETE` Reasonable Inquiry Data	The 'reasonable inquiry' backing the contractor representation needs entries with both name and version so items can be traced to their origin (FAR 52.204-24 representation after reasonable inquiry)	Scan
`NDAA889-PROV` Documented Provenance	Representations must be supportable by documented provenance of who compiled the equipment and software inventory (NDAA FY2019 §889(a)(1)(B) use prohibition; FAR 52.204-24)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`NDAA889-A-01`	Prohibit procurement of covered telecommunications equipment
`NDAA889-A-02`	Screen existing infrastructure for covered telecom equipment
`NDAA889-B-01`	Certify non-use of covered equipment in contract representations
`NDAA889-B-02`	Conduct due diligence on supply chain for covered equipment
`NDAA889-C-01`	Report discovery of covered equipment during contract performance
`NDAA889-D-01`	Flow-down Section 889 requirements to subcontractors
`NDAA889-E-01`	Maintain records of Section 889 compliance activities
`NDAA889-F-01`	Review and update Section 889 covered entity list

Policy templates

Written for NDAA 889:

NDAA Section 889 Prohibited Technology Policy
Section 889 Supply Chain Screening and Representation Policy
Section 889 Subcontractor Flowdown and Compliance Policy

And 22 from the standard set, adapted to NDAA 889.