Prove FAR 52.204-25 Section 889 compliance across your estate
FAR 52.204-25 is the Federal Acquisition Regulation clause that implements Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019. It prohibits federal contractors from supplying covered telecommunications or video surveillance equipment and services to the government, and from using them anywhere in their own business. Contractors must also report any covered equipment they find within one business day.
Is FAR 52.204-25 right for your organisation?
Any organisation that holds or bids for a US federal contract, as a prime or a subcontractor, needs to meet FAR 52.204-25, because the clause flows down to subcontracts at every tier, including commercial products and services. The Part B prohibition applies to the contractor's own use of covered equipment, regardless of whether that use is connected to federal work, so UK and other non-US suppliers to US agencies are caught too.
It is usually required by customers, partners or schemes rather than by law.
- Issued by
- FAR Council (DoD, GSA and NASA)
- Implements
- Section 889 of the FY2019 National Defense Authorization Act (Pub. L. 115-232)
- Current version
- Clause dated November 2021, prescribed at FAR 4.2105(b)
- Prohibitions effective
- Part A from 13 August 2019; Part B from 13 August 2020
- Covered companies
- Huawei, ZTE, Hytera, Hikvision and Dahua, plus their subsidiaries and affiliates
- Reporting deadline
- Initial report within one business day; follow-up within 10 business days
- Applies to
- Federal prime contractors and all subcontract tiers
- Type
- Regulation (contractual)
- Region
- United States, US
- In OneClickComply
- Supported today
OneClickComply makes it simple
OneClickComply has FAR 52.204-25 mapped in its control library and makes it available on request. It helps you build an inventory of network, telecoms and camera equipment from connected tools, track suppliers through vendor risk management, and keep a documented record of the reasonable inquiry and reporting steps the clause expects. Continuous monitoring and Ask an Auditor support help you keep that position current between contract representations.
Requirements covered
One contract clause with five paragraphs: definitions (a), the two Section 889 prohibitions (b)(1) and (b)(2), two exceptions (c), reporting obligations (d) with one-business-day and ten-business-day deadlines, and mandatory subcontract flowdown (e).
Already working towards another framework?
- SOC 260% of FAR 52.204-25 overlaps
Evidence you collect once counts towards every framework it applies to.
Manual FAR 52.204-25 vs. OneClickComply
- Asset lists live in spreadsheets that miss cameras, routers and phones bought locally
- Supplier brands and OEMs behind white-labelled kit are hard to trace
- Proving a reasonable inquiry means chasing emails and screenshots before each bid
- A one-business-day reporting deadline is hard to meet with no ready data
- Subcontractor flowdown and responses are tracked by hand across many contracts
- Connected tools keep a current inventory of network and device assets
- Vendor risk management records suppliers and manufacturers in one place
- Evidence of your inquiry is collected and kept ready for representations
- Brand, model and supplier details are on hand when a report is due
- Supplier assessments and questionnaires track flowdown across your supply chain
Everything you need for FAR 52.204-25
Equipment and device inventory drawn from connected network, cloud and endpoint tools
Vendor risk records that flag telecoms and video surveillance suppliers for review
Documented reasonable inquiry trail to support your Section 889 representations
Continuous monitoring with alerts when new devices or suppliers appear
Policy generation for procurement and supplier screening from your real environment
Ask an Auditor guidance on reporting, exceptions and subcontract flowdown
Three steps to FAR 52.204-25 compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against FAR 52.204-25 and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates FAR 52.204-25-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
FAR 52.204-25 (Section 889) requirements
All paragraphs of the FAR 52.204-25 clause (November 2021), with the exceptions and reporting deadlines shown as separate sub-paragraphs.
| Reference | Requirement |
|---|---|
| 52.204-25(a) | Definitions, including covered telecommunications equipment or services |
| 52.204-25(b)(1) | Prohibition on providing covered equipment or services (Section 889 Part A) |
| 52.204-25(b)(2) | Prohibition on using covered equipment or services (Section 889 Part B) |
| 52.204-25(c)(1) | Exception for third-party connections such as backhaul, roaming or interconnection |
| 52.204-25(c)(2) | Exception for equipment that cannot route, redirect or view user data |
| 52.204-25(d)(1) | Reporting to the Contracting Officer or DIBNet when covered equipment is identified |
| 52.204-25(d)(2)(i) | Initial report within one business day |
| 52.204-25(d)(2)(ii) | Mitigation and prevention report within 10 business days |
| 52.204-25(e) | Subcontract flowdown, excluding paragraph (b)(2) |
Always check the official FAR 52.204-25 text for the exact wording.
FAR 52.204-25 FAQs
What is FAR 52.204-25?
FAR 52.204-25 is the US federal contract clause titled Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. It implements Section 889 of the FY2019 National Defense Authorization Act, banning contractors from providing covered equipment to the government and from using it in their own operations. It also sets reporting duties and requires flowdown to subcontracts.
Which companies are covered by Section 889 and FAR 52.204-25?
The clause covers telecommunications equipment from Huawei and ZTE, and, for public safety, government facility security, critical infrastructure surveillance and other national security purposes, video surveillance and telecoms equipment from Hytera, Hikvision and Dahua. Subsidiaries and affiliates are included, as are services using such equipment and any entity the Secretary of Defense reasonably believes is owned or controlled by, or connected to, the government of China.
What is the difference between Section 889 Part A and Part B?
Part A, in paragraph (b)(1), stops contractors from providing the government with any equipment, system or service that uses covered telecommunications as a substantial or essential component, from 13 August 2019. Part B, in paragraph (b)(2), stops agencies contracting with any entity that uses such equipment, from 13 August 2020, regardless of whether the use relates to federal work. Part B is not flowed down to subcontracts.
What must a contractor report under FAR 52.204-25?
If a contractor identifies covered equipment or services during contract performance, or is told of it by a subcontractor or other source, it must report to the Contracting Officer, or to dibnet.dod.mil for Defense contracts. Within one business day it reports contract details, supplier, brand, model and description. Within 10 further business days it reports mitigation actions and prevention efforts.
Are there exceptions to the FAR 52.204-25 prohibition?
Yes. Paragraph (c) allows contractors to provide a service that connects to third-party facilities, such as backhaul, roaming or interconnection arrangements. It also allows telecommunications equipment that cannot route or redirect user data traffic or give visibility into user data or packets. Separately, agencies may grant waivers under FAR 4.2104, but contractors cannot rely on one unless it has been granted.
What are the consequences of not complying with FAR 52.204-25?
Non-compliance can make a company ineligible for federal contract awards, extensions or renewals, because agencies are prohibited from contracting with entities that use covered equipment. Inaccurate representations made under the related provisions FAR 52.204-24 and 52.204-26 can also expose a contractor to contract remedies and wider legal liability, so a documented, reasonable inquiry is important.
How does FAR 52.204-25 relate to FAR 52.204-21 and CMMC?
They address different risks. FAR 52.204-25 is a supply chain prohibition on specific Chinese telecoms and video surveillance vendors, while FAR 52.204-21 sets basic safeguarding controls for federal contract information, and CMMC assesses cyber security practices for Defense contractors. Many contractors face all three, so an asset and supplier inventory built for one usefully supports the others.
Does OneClickComply support FAR 52.204-25?
FAR 52.204-25 is mapped in OneClickComply's control library and is available on request. OneClickComply helps you maintain asset and supplier inventories, record your reasonable inquiry, monitor for new devices and manage supplier assessments. It does not certify compliance or make representations on your behalf, but it gives you organised evidence to support them.
Related standards
All standards- FAR 52.204-21 Basic Safeguarding of Covered Contractor Information SystemsRegulation · US
- FAR 52.204-27 Prohibition on a ByteDance Covered ApplicationRegulation · US
- HIPAA Administrative Simplification RegulationsRegulation · US
- NISPOM (32 CFR Part 117)Regulation · US
- NYDFS Cybersecurity Regulation (23 NYCRR Part 500)Regulation · US
- HIPAA Security RuleRegulation · US
- Unclassified Naval Nuclear Propulsion Information (U-NNPI)Regulation · US
- TSA Security Directive 1580/82-2022-01: Rail Cybersecurity Mitigation Actions and TestingRegulation · US
Get FAR 52.204-25 ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.