NDAA Compliance: What UK Businesses and Schools Need to Know About Section 889

If you have been involved in procuring CCTV equipment for a school, local authority or public sector organisation in the last couple of years, there is a good chance you have encountered the term NDAA compliance. It sounds like an American concern -- and technically it is -- but its reach into UK procurement is growing, and it is worth understanding what it actually means before your next system upgrade.

What is the NDAA?

The National Defense Authorization Act is annual US legislation that sets the defence budget and policy for the American government. Section 889 of the 2019 Act specifically prohibits US federal agencies -- and their contractors and sub-contractors -- from procuring or using telecommunications and video surveillance equipment manufactured by a defined list of Chinese companies.

The companies named in Section 889 include Hikvision, Dahua, Huawei, ZTE and Hytera. This covers not just equipment sold directly under these brand names, but also equipment made by their subsidiaries or using their components -- which is a wider category than many people realise.

Why does a US law affect UK organisations?

Three main reasons. First, many UK organisations -- particularly in defence, aerospace, and technology -- have contracts with the US federal government or with prime contractors who are subject to the NDAA. Those organisations are required to cascade the restriction down their supply chain, which means UK-based sub-contractors and suppliers must also comply.

Second, several UK public sector bodies have adopted NDAA compliance as part of their own procurement policy, independently of any US requirement. Coventry City Council, like many local authorities, has reviewed its position on Chinese-manufactured surveillance equipment following guidance from the NCSC (National Cyber Security Centre) and Parliamentary debates on the subject.

Third, schools and academy trusts receiving central government funding -- including DfE capital grants -- are increasingly asked by their funding bodies to demonstrate that their technology procurement meets security standards, which often includes NDAA Section 889 compliance.

What about Hikvision specifically?

This is where it gets commercially sensitive. Hikvision is the world's largest CCTV manufacturer and is installed in millions of sites across the UK -- including schools, hospitals, retail chains and council buildings. The equipment is technically excellent and Hikvision holds accreditation with the BSIA and various UK industry bodies.

However, Hikvision is listed in Section 889 and is therefore non-compliant for organisations subject to NDAA restrictions. The UK government has also banned new Hikvision installations in sensitive government buildings following a 2022 review, though this ban does not currently extend to schools or local authorities.

We are a Hikvision VASP (Value Added Solution Provider) and we install Hikvision equipment regularly for commercial clients where it is entirely appropriate. But for clients with NDAA requirements, we specify from a different set of manufacturers.

Which cameras are NDAA-compliant?

There is no official "approved" list, but manufacturers who market their cameras as NDAA Section 889 compliant and whose products are commonly specified in NDAA-sensitive environments include Axis Communications (Sweden), Hanwha Vision (South Korea), Bosch Security (Germany), Avigilon (Canada, owned by Motorola Solutions), and Verkada (US). Some of these carry a price premium over Hikvision, though the gap has narrowed as demand has grown.

Our preferred NVR platform, Synology Surveillance Station, is itself camera-agnostic and is not subject to NDAA restrictions -- which makes it an excellent backbone for NDAA-compliant systems, able to work with any of the approved manufacturers above.

What should you do if you are unsure?

Start by checking your funding conditions or any contracts you hold with US federal agencies or their prime contractors. If you are a school in receipt of DfE capital funding, check your grant conditions. If you are a local authority or public sector body, check whether your procurement policy has been updated to include NDAA restrictions.

If you are planning a new CCTV installation and any of the above apply, tell your installer before specification begins -- not after. Retrofitting NDAA compliance onto a system designed around Hikvision hardware is expensive. Getting it right at the design stage costs nothing extra.

We carry out free site surveys and will advise honestly on whether NDAA compliance is relevant to your situation and what the camera options are. If it is not relevant, we will tell you that too -- there is no commercial reason to specify more expensive cameras unnecessarily.