OneClickComply
    FAR 52.204-25 (Section 889)Supported in OneClickComply

    Prove FAR 52.204-25 Section 889 compliance across your estate

    FAR 52.204-25 is the Federal Acquisition Regulation clause that implements Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019. It prohibits federal contractors from supplying covered telecommunications or video surveillance equipment and services to the government, and from using them anywhere in their own business. Contractors must also report any covered equipment they find within one business day.

    See the FAR 52.204-25 requirements
    FAR 52.204-25 Aligned
    Automated Evidence
    OneClickFix Enabled
    Continuous Monitoring
    In-House Audit Team
    Who needs FAR 52.204-25

    Is FAR 52.204-25 right for your organisation?

    Any organisation that holds or bids for a US federal contract, as a prime or a subcontractor, needs to meet FAR 52.204-25, because the clause flows down to subcontracts at every tier, including commercial products and services. The Part B prohibition applies to the contractor's own use of covered equipment, regardless of whether that use is connected to federal work, so UK and other non-US suppliers to US agencies are caught too.

    It is usually required by customers, partners or schemes rather than by law.

    FAR 52.204-25 at a glance
    Issued by
    FAR Council (DoD, GSA and NASA)
    Implements
    Section 889 of the FY2019 National Defense Authorization Act (Pub. L. 115-232)
    Current version
    Clause dated November 2021, prescribed at FAR 4.2105(b)
    Prohibitions effective
    Part A from 13 August 2019; Part B from 13 August 2020
    Covered companies
    Huawei, ZTE, Hytera, Hikvision and Dahua, plus their subsidiaries and affiliates
    Reporting deadline
    Initial report within one business day; follow-up within 10 business days
    Applies to
    Federal prime contractors and all subcontract tiers
    Type
    Regulation (contractual)
    Region
    United States, US
    In OneClickComply
    Supported today
    How we help

    OneClickComply makes it simple

    OneClickComply has FAR 52.204-25 mapped in its control library and makes it available on request. It helps you build an inventory of network, telecoms and camera equipment from connected tools, track suppliers through vendor risk management, and keep a documented record of the reasonable inquiry and reporting steps the clause expects. Continuous monitoring and Ask an Auditor support help you keep that position current between contract representations.

    Requirements covered

    One contract clause with five paragraphs: definitions (a), the two Section 889 prohibitions (b)(1) and (b)(2), two exceptions (c), reporting obligations (d) with one-business-day and ten-business-day deadlines, and mandatory subcontract flowdown (e).

    Already working towards another framework?

    • SOC 260% of FAR 52.204-25 overlaps

    Evidence you collect once counts towards every framework it applies to.

    Manual FAR 52.204-25 vs. OneClickComply

    Manual FAR 52.204-25
    • Asset lists live in spreadsheets that miss cameras, routers and phones bought locally
    • Supplier brands and OEMs behind white-labelled kit are hard to trace
    • Proving a reasonable inquiry means chasing emails and screenshots before each bid
    • A one-business-day reporting deadline is hard to meet with no ready data
    • Subcontractor flowdown and responses are tracked by hand across many contracts
    With OneClickComply
    • Connected tools keep a current inventory of network and device assets
    • Vendor risk management records suppliers and manufacturers in one place
    • Evidence of your inquiry is collected and kept ready for representations
    • Brand, model and supplier details are on hand when a report is due
    • Supplier assessments and questionnaires track flowdown across your supply chain
    Capabilities

    Everything you need for FAR 52.204-25

    Equipment and device inventory drawn from connected network, cloud and endpoint tools

    Vendor risk records that flag telecoms and video surveillance suppliers for review

    Documented reasonable inquiry trail to support your Section 889 representations

    Continuous monitoring with alerts when new devices or suppliers appear

    Policy generation for procurement and supplier screening from your real environment

    Ask an Auditor guidance on reporting, exceptions and subcontract flowdown

    How it works

    Three steps to FAR 52.204-25 compliance

    01

    Connect & scan

    Connect your cloud, identity and SaaS tools. OneClickComply checks them against FAR 52.204-25 and shows you exactly where you stand.

    02

    Fix & generate

    OneClickFix remediates technical gaps in one click, and AutoComplete generates FAR 52.204-25-aligned policies from your real environment.

    03

    Monitor & evidence

    Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

    Requirements

    FAR 52.204-25 (Section 889) requirements

    All paragraphs of the FAR 52.204-25 clause (November 2021), with the exceptions and reporting deadlines shown as separate sub-paragraphs.

    ReferenceRequirement
    52.204-25(a)Definitions, including covered telecommunications equipment or services
    52.204-25(b)(1)Prohibition on providing covered equipment or services (Section 889 Part A)
    52.204-25(b)(2)Prohibition on using covered equipment or services (Section 889 Part B)
    52.204-25(c)(1)Exception for third-party connections such as backhaul, roaming or interconnection
    52.204-25(c)(2)Exception for equipment that cannot route, redirect or view user data
    52.204-25(d)(1)Reporting to the Contracting Officer or DIBNet when covered equipment is identified
    52.204-25(d)(2)(i)Initial report within one business day
    52.204-25(d)(2)(ii)Mitigation and prevention report within 10 business days
    52.204-25(e)Subcontract flowdown, excluding paragraph (b)(2)

    Always check the official FAR 52.204-25 text for the exact wording.

    FAR 52.204-25 FAQs

    What is FAR 52.204-25?

    FAR 52.204-25 is the US federal contract clause titled Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment. It implements Section 889 of the FY2019 National Defense Authorization Act, banning contractors from providing covered equipment to the government and from using it in their own operations. It also sets reporting duties and requires flowdown to subcontracts.

    Which companies are covered by Section 889 and FAR 52.204-25?

    The clause covers telecommunications equipment from Huawei and ZTE, and, for public safety, government facility security, critical infrastructure surveillance and other national security purposes, video surveillance and telecoms equipment from Hytera, Hikvision and Dahua. Subsidiaries and affiliates are included, as are services using such equipment and any entity the Secretary of Defense reasonably believes is owned or controlled by, or connected to, the government of China.

    What is the difference between Section 889 Part A and Part B?

    Part A, in paragraph (b)(1), stops contractors from providing the government with any equipment, system or service that uses covered telecommunications as a substantial or essential component, from 13 August 2019. Part B, in paragraph (b)(2), stops agencies contracting with any entity that uses such equipment, from 13 August 2020, regardless of whether the use relates to federal work. Part B is not flowed down to subcontracts.

    What must a contractor report under FAR 52.204-25?

    If a contractor identifies covered equipment or services during contract performance, or is told of it by a subcontractor or other source, it must report to the Contracting Officer, or to dibnet.dod.mil for Defense contracts. Within one business day it reports contract details, supplier, brand, model and description. Within 10 further business days it reports mitigation actions and prevention efforts.

    Are there exceptions to the FAR 52.204-25 prohibition?

    Yes. Paragraph (c) allows contractors to provide a service that connects to third-party facilities, such as backhaul, roaming or interconnection arrangements. It also allows telecommunications equipment that cannot route or redirect user data traffic or give visibility into user data or packets. Separately, agencies may grant waivers under FAR 4.2104, but contractors cannot rely on one unless it has been granted.

    What are the consequences of not complying with FAR 52.204-25?

    Non-compliance can make a company ineligible for federal contract awards, extensions or renewals, because agencies are prohibited from contracting with entities that use covered equipment. Inaccurate representations made under the related provisions FAR 52.204-24 and 52.204-26 can also expose a contractor to contract remedies and wider legal liability, so a documented, reasonable inquiry is important.

    How does FAR 52.204-25 relate to FAR 52.204-21 and CMMC?

    They address different risks. FAR 52.204-25 is a supply chain prohibition on specific Chinese telecoms and video surveillance vendors, while FAR 52.204-21 sets basic safeguarding controls for federal contract information, and CMMC assesses cyber security practices for Defense contractors. Many contractors face all three, so an asset and supplier inventory built for one usefully supports the others.

    Does OneClickComply support FAR 52.204-25?

    FAR 52.204-25 is mapped in OneClickComply's control library and is available on request. OneClickComply helps you maintain asset and supplier inventories, record your reasonable inquiry, monitor for new devices and manage supplier assessments. It does not certify compliance or make representations on your behalf, but it gives you organised evidence to support them.

    Get FAR 52.204-25 ready, not stressed

    Automate controls, gather evidence continuously and stay audit-ready, all on one platform.