No, Hikvision cameras are not NDAA compliant. Hikvision is one of five manufacturers named in Section 889 of the National Defense Authorization Act (NDAA), which bars federal agencies, federal contractors, and organizations that receive federal grants from buying or using its video surveillance equipment.
The restriction reaches further than most buyers expect. It covers every Hikvision-branded camera, recorder, and video management system, plus rebranded and OEM gear built on Hikvision components, no matter where or when it was purchased. As a commercial security installer approved on more than 15 government purchasing vehicles, we help organizations confirm whether their equipment is affected and move to compliant systems when it is.
Key Takeaways
- Hikvision is banned under NDAA Section 889 and cannot be procured or used by federal agencies, federal contractors, or federal grant recipients.
- The ban covers components, not just brand names. Rebranded, OEM, and white-label cameras built on Hikvision or HiSilicon parts fall under the same restriction.
- There is no official “NDAA certification.” NDAA compliance is a sourcing fact about a manufacturer, not a logo or a certificate, so it has to be verified model by model.
- The FCC banned new Hikvision equipment separately. Since 2022 the FCC has refused new equipment authorizations, which limits fresh stock, replacement parts, and long-term support.
- Private businesses with no federal ties are not legally barred from using existing Hikvision cameras, but documented security flaws and shrinking support make replacement worth weighing.
- Compliant alternatives exist at every tier, including Verkada, Axis, Avigilon, Bosch, and Digital Watchdog, and existing cabling can usually be reused to cut replacement cost.
Have a security project?
Is Hikvision NDAA Compliant?
No. Hikvision is explicitly named in Section 889 of the National Defense Authorization Act as a prohibited manufacturer. The statute, carried into federal contracting rules at FAR 52.204-25, names video surveillance equipment from Hangzhou Hikvision Digital Technology, Dahua Technology, and Hytera Communications, alongside telecommunications equipment from Huawei and ZTE.
Section 889 works in two parts, and the difference matters for who is affected. Part (a)(1)(A) prohibits federal agencies from procuring covered equipment. Part (a)(1)(B) goes further and bars agencies from contracting with any organization that uses covered equipment anywhere in its operations, even on work unrelated to the government.
There is no official “NDAA compliant” certificate, logo, or approving body. NDAA compliance is not a standard a lab tests against. It is a statement about who made a device and what parts are inside it, which means “NDAA compliant” is a claim you verify against the manufacturer and the specific model, not a badge you look for on a box.
Why Is Hikvision Banned Under the NDAA?
National security concerns drove the federal prohibition of Hikvision equipment. Three issues came up repeatedly as Congress built the case for the ban.
- Chinese state ownership. The Chinese government is the controlling shareholder of Hikvision, holding roughly 42% through subsidiaries of the state-owned China Electronics Technology Group, according to analysis from the Center for Strategic and International Studies. Chinese law also requires companies to assist state intelligence services on request, which lawmakers viewed as a standing risk for any Hikvision device on a sensitive network.
- Documented cybersecurity flaws. A backdoor vulnerability in Hikvision cameras, tracked as CVE-2017-7921, let an attacker bypass authentication and take control of a device. The Cybersecurity and Infrastructure Security Agency rated it at the maximum severity score of 10.0 and described it as remotely exploitable with a low skill level required to exploit.
- Human rights concerns. Hikvision has faced documented allegations of supplying surveillance systems used against ethnic minorities in China, which added bipartisan weight to the restrictions.
Together, state control, a critical documented vulnerability, and legal obligations to cooperate with intelligence services led Congress to treat Hikvision equipment as incompatible with federal security requirements.
Did the FCC Also Ban Hikvision?
Yes. The FCC restricted Hikvision separately from Section 889, on a different legal track. Hikvision sits on the FCC Covered List of equipment judged to pose an unacceptable risk to national security.
The FCC stopped granting new equipment authorizations for covered Hikvision video surveillance gear in order FCC 22-84, released November 25, 2022, which blocks the import and sale of new devices in the United States. The practical effect for buyers is a shrinking supply of new units, replacement parts, and firmware support over time, which is a real consideration even for organizations the procurement ban never touches.
Can You Still Use Hikvision Cameras Legally?
It depends entirely on your relationship with the federal government. The federal contracting rules bind federal buyers and their contractors, not every business in the country.
- Federal agencies cannot procure, use, or maintain Hikvision equipment. Existing systems must be removed and replaced with compliant alternatives.
- Federal contractors face the broadest reach under Section 889(a)(1)(B). If your organization holds or wants a federal contract, you cannot use Hikvision equipment anywhere in your operations, including areas with no connection to government work. This applies to contractors of every size.
- Federal grant recipients cannot use grant funds to buy Hikvision equipment, and grant rules can extend compliance obligations to the wider project.
- Private businesses with no federal contracts or funding face no federal law barring the use of existing Hikvision cameras. The decision here is a risk and support question, not a legal one.
The line that matters is federal money. Cross it, through a contract or a grant, and compliance becomes mandatory. Stay on the private side of it and the choice is yours, though the security and support tradeoffs below are worth weighing before you keep the equipment in place.
Have a security project?
Do You Have to Replace Your Hikvision Cameras?
Whether you have to replace Hikvision cameras comes down to the same federal-money test. The answer splits cleanly into two cases.
If you have or want federal contracts or grants, replacement is mandatory. There is no configuration, firmware update, or network setting that makes a Hikvision camera compliant, because compliance is about the manufacturer, not the settings. Prime contractors can also push the requirement down to subcontractors, so the obligation can reach you through a client rather than a direct government contract.
If you are a private business with no federal ties, replacement is optional but worth planning. Some organizations choose to isolate existing cameras rather than replace them immediately, placing all cameras and recorders on a segmented network with no internet access and no path to the rest of the corporate LAN, so a compromised device cannot reach sensitive systems. This reduces exposure, but it does not eliminate the documented vulnerabilities, and it does not restore the manufacturer support the FCC action is winding down.
Two facts should shape the decision. First, cameras pointed at sensitive areas, such as server rooms, cash handling, or anything tied to regulated data, are the highest priority to replace regardless of federal status. Second, a future bid or grant application can arrive with little warning, and an emergency rip-and-replace under a contract deadline costs far more than a planned transition. Most existing coaxial or network cabling can be reused when you upgrade, which keeps the cost of a planned migration well below a full rebuild.
How to Check if a Camera System Is NDAA Compliant
Verifying NDAA compliance means checking the manufacturer, the internal components, and the paperwork, because brand name alone is not enough.
- Check the manufacturer first. Cameras branded Hikvision, Dahua, Huawei, Hytera, or ZTE are non-compliant by name. Be careful with rebranded and OEM lines, and do not rely on ownership you remember from years ago. Lorex, for example, was a Dahua subsidiary until Dahua sold it to Skywatch in 2022, yet legacy Lorex hardware can still contain Dahua-origin technology, so the model still has to be verified.
- Verify the chipset. The system-on-chip is the camera’s processor, and a compliant brand can still ship a non-compliant part. According to surveillance-industry reporting from IPVM, HiSilicon chips are made by Huawei and are treated as covered, while processors from Ambarella and Texas Instruments are widely used in compliant cameras. Ask the manufacturer to document the chip source.
- Request a written compliance statement. Reputable manufacturers publish NDAA and Section 889 compliance documentation for their product lines. Get it in writing for the specific models you are buying.
- Review purchase and installation records. Invoices, spec sheets, and install documentation identify makes and models on equipment you already own. Where records are incomplete, a physical inspection may be the only way to confirm what is on the wall.
For larger or mixed installations, a full site audit identifies every affected device and supports a prioritized replacement plan that keeps coverage in place during the transition.
Why Choose NDAA-Compliant Cameras Even When Not Required
Compliant cameras are the safer long-term choice even for businesses the law never touches. Four practical reasons hold up regardless of federal status.
- Support longevity. The FCC action restricts new Hikvision equipment, parts, and, over time, firmware. A system that stops receiving security patches grows more vulnerable as new threats appear.
- Documented security risk. The backdoor and authentication flaws that drove the federal restrictions do not disappear for private users. A compromised camera can become an entry point into the wider network, not just a surveillance problem.
- Future flexibility. Contracts and grant opportunities can appear with short deadlines. Organizations already on compliant equipment can pursue them without an emergency replacement project.
- Reputation. Clients, insurers, and partners increasingly review vendor security practices. Running equipment banned by the federal government raises questions that are easy to avoid.
For a fuller list of approved models across budgets, see our guide to NDAA-compliant security cameras.
NDAA-Compliant Alternatives to Hikvision
Several manufacturers make NDAA-compliant cameras that match or exceed Hikvision on features. The compliant lines we install include Verkada, Axis, Avigilon, Bosch, and Digital Watchdog. Confirm the specific model against the manufacturer’s compliance statement, since compliance is verified per product line.
- Verkada builds cloud-managed cameras with browser-based administration and no on-site recorder. Verkada publishes a compliance statement confirming its government-grade cameras carry FIPS 140-validated encryption and are TAA and FY2019 NDAA compliant.
- Axis Communications pioneered network video and manufactures in Sweden. Axis publishes an NDAA compliance statement affirming its full product portfolio meets Section 889, with an emphasis on open standards and signed firmware.
- Avigilon (Motorola Solutions) makes end-to-end camera and video management systems with on-board AI analytics. Avigilon states its solutions are designed and manufactured in the US and Canada and are NDAA compliant.
- Bosch Security Systems builds cameras with on-device video analytics and rugged, weather-resistant housings.
- Digital Watchdog is a US company that makes NDAA-compliant cameras at mid-market price points.
- Hanwha Vision, Pelco, and Vivotek are additional NDAA-compliant options in the market, with Hanwha manufacturing in South Korea and Pelco based in the US.
Each brand differs in analytics, price, and integration. The right choice depends on your requirements, budget, and existing infrastructure rather than a single preferred line.
Frequently Asked Questions
Is Hikvision banned in the USA?
Hikvision is banned for federal use and blocked from new US market authorizations, but not banned outright for private owners. Federal agencies, contractors, and grant recipients cannot buy or use it under Section 889, and the FCC has stopped authorizing new Hikvision video surveillance equipment for import or sale. A private business with no federal ties can still legally use equipment it already owns.
Is Dahua NDAA compliant?
No. Dahua Technology is named alongside Hikvision in Section 889 and appears on the FCC Covered List, so the same federal restrictions apply. Rebranded and OEM cameras built on Dahua components are covered too, which is why the manufacturer and chipset both have to be checked.
Do private businesses have to remove Hikvision cameras?
Private businesses with no federal contracts or grants are not legally required to remove Hikvision cameras. The trade-offs are shrinking support and parts availability following the FCC action, and the documented cybersecurity vulnerabilities behind the federal ban. Many private owners isolate the cameras on a segmented network as an interim step and plan a phased replacement.
Is “NDAA compliant” an official certification?
No. There is no official NDAA certification, logo, or certifying body. NDAA compliance describes whether a device and its components come from manufacturers not prohibited under Section 889. Because it is a sourcing fact rather than a lab certification, it has to be confirmed against the manufacturer’s own compliance documentation for each specific model.
What is the Hikvision security flaw?
The most serious Hikvision flaw is a backdoor, tracked as CVE-2017-7921, that let an attacker bypass authentication and access camera systems without valid credentials. CISA rated it at the maximum severity of 10.0. Hikvision released patches, but the pattern of vulnerabilities, combined with state ownership, was central to the federal decision to ban the equipment.
Are Hikvision cameras ONVIF compliant?
Many Hikvision cameras support ONVIF profiles, which let them interoperate with third-party video management systems. ONVIF compliance is unrelated to NDAA compliance. ONVIF is an interoperability standard, while NDAA is a federal procurement restriction, so an ONVIF-compatible Hikvision camera is still prohibited for federal use.
Is Hikvision GDPR compliant?
Hikvision states its products can be configured to meet the European Union’s General Data Protection Regulation, which governs personal data handling. GDPR and NDAA address different issues. GDPR concerns data privacy, while NDAA concerns national security and manufacturer origin, so meeting one says nothing about the other.
The Bottom Line
Hikvision cameras are not NDAA compliant, and for federal agencies, contractors, and grant recipients that means the equipment cannot be used and existing systems have to be replaced. Private businesses have more room to decide, but the FCC’s restrictions on new equipment, the documented cybersecurity flaws, and the value of staying eligible for future contracts all point toward planning a move to compliant cameras.
As a commercial security installer serving businesses and government agencies nationwide, approved on more than 15 government procurement vehicles and protecting over 20,000 locations across 19-plus years, Safe and Sound Security helps organizations verify what they have, prioritize what to replace, and transition to NDAA-compliant systems with minimal disruption. We handle the site audit, the compliant camera selection, and the installation, and we reuse existing infrastructure wherever it makes sense to keep costs down.
If you need to confirm whether your cameras meet federal requirements or plan a compliant upgrade, contact us for a site assessment.
Have a security project?
Sources
- Acquisition.gov: FAR 52.204-25
- FCC: Covered List
- FCC: Report and Order on Equipment Authorization
- CISA: ICS Advisory ICSA-17-124-01
- Center for Strategic and International Studies: Hikvision Corporate Governance and Risks
- IPVM: HiSilicon Chip Check
- Dahua: Sale of Lorex Subsidiary
- Axis Communications: NDAA Compliance
- Avigilon: NDAA Compliance
- Verkada: Compliance
