NDAA Compliant Security Cameras: A Guide for UK Organisations

NDAA compliance for security cameras refers to meeting the requirements of Section 889 of the US National Defense Authorization Act, which bans the use of surveillance equipment manufactured by specific Chinese companies including Hikvision, Dahua, Huawei, Hytera, and ZTE. In simpler terms, an NDAA-compliant camera is one that contains no components from these restricted manufacturers.

Although this is US legislation, NDAA compliance is becoming increasingly relevant in the UK. In November 2022, the UK government directed departments to stop installing Chinese-made surveillance cameras in sensitive government sites. For any organisation responsible for protecting people, property, or sensitive data, understanding NDAA compliance is now an important part of CCTV procurement.

What Does NDAA Compliance Mean for Security Cameras?

Section 889 of the 2019 National Defense Authorization Act prohibits US federal agencies and their contractors from procuring or using telecommunications and video surveillance equipment from five named Chinese manufacturers. These are Huawei Technologies, ZTE Corporation, Hangzhou Hikvision Digital Technology, Dahua Technology, and Hytera Communications, along with any of their subsidiaries or affiliates.

For a security camera to be considered NDAA compliant, it must not contain any components, chipsets, or software from these banned companies. This goes beyond the brand name on the camera itself. A camera manufactured by a compliant brand could still fall outside compliance if it uses internal components sourced from a restricted manufacturer.

NDAA-compliant cameras are typically produced by manufacturers such as Axis Communications, Bosch, Hanwha Techwin, Avigilon, and Mobotix. These companies design and source their components independently of the banned supply chains.

Understanding the difference between IP and analogue CCTV systems is also relevant here, because NDAA restrictions primarily affect networked IP cameras that transmit data over a network, where cybersecurity risks are most significant. Knowing how CCTV cameras work at a technical level helps organisations make informed decisions about which systems meet compliance requirements.

Why NDAA Compliance Matters for UK Organisations

The NDAA is US legislation, but its implications extend well beyond American borders. In November 2022, the UK Cabinet Office issued a directive instructing government departments to stop installing surveillance cameras manufactured by companies subject to the Chinese intelligence laws on sensitive sites, and to consider removing existing equipment. This directive directly referenced concerns about Hikvision and Dahua products.

Several factors make NDAA compliance increasingly important for UK organisations.

• Cybersecurity risks. Non-compliant cameras have been associated with potential vulnerabilities, including backdoors that could allow unauthorised access to video feeds and connected networks. For any organisation handling sensitive information or operating on sites where security is paramount, this represents a significant risk.
• Data protection obligations. Under the UK GDPR and the Data Protection Act 2018, organisations must take appropriate technical measures to protect personal data. CCTV footage is personal data. Using surveillance equipment with known security vulnerabilities could be considered a failure to meet these obligations. The rules for CCTV and CCTV laws in the UK already require careful consideration of how footage is captured, stored, and accessed.
• Supply chain integrity. Procurement teams across the public sector are increasingly being asked to demonstrate that their supply chains do not include products from manufacturers flagged as security risks. For organisations bidding on government contracts, having non-compliant CCTV equipment could affect eligibility.
• Regulatory direction. The UK government’s actions in 2022 suggest a trajectory towards stricter regulation of surveillance equipment origins. Organisations that transition to compliant systems now will avoid costly reactive replacements if further restrictions are introduced.

Steve Hardcastle

CTO at Clearway

Steve Hardcastle

Understanding the origin of every component in a CCTV system is becoming as important as the camera specification itself. Organisations that take a proactive approach to supply chain security in their surveillance infrastructure are better positioned to meet both current guidance and future regulatory requirements.

Looking for guidance on NDAA-compliant CCTV for your organisation? Contact the Clearway team to discuss your requirements.

Which UK Organisations Need NDAA-Compliant CCTV?

While there is no UK law that mandates NDAA compliance for private organisations, several types of organisation should prioritise compliant CCTV equipment.

• Public sector bodies. Local authorities, councils, police forces, and NHS trusts are directly affected by the 2022 government directive. These organisations handle large volumes of sensitive data and are subject to heightened scrutiny over their procurement decisions. Many are already transitioning away from restricted manufacturers.
• Critical infrastructure operators. Sites across utilities, energy, transport, and telecommunications are classified as critical national infrastructure. The security of surveillance systems at these sites is a matter of national importance. CCTV towers deployed at infrastructure sites should use compliant equipment to avoid potential vulnerabilities.
• Construction firms with government contracts. Construction companies working on public sector projects, government buildings, or infrastructure schemes may be contractually required to use compliant surveillance equipment. Temporary site security, including mobile CCTV, should meet the same compliance standards as permanent installations.
• Organisations with US connections. Any UK company that contracts with US federal agencies, receives US government funding, or operates as part of a supply chain serving the US government must comply with Section 889.
• Private sector organisations prioritising security. Even without a regulatory requirement, many private organisations are choosing NDAA-compliant systems. The cybersecurity benefits, combined with stronger hardware quality from compliant manufacturers, make this a sound investment for any site where security performance matters.

A security risk assessment can help determine the appropriate level of compliance for your specific site and operational requirements.

How to Check and Transition to NDAA-Compliant Cameras

If your organisation is considering a move to NDAA-compliant CCTV, a structured approach will ensure a smooth transition without gaps in coverage.

• Audit your existing CCTV infrastructure. Start by documenting every camera, recorder, and networked device across your sites. Record the manufacturer, model number, and installation date for each piece of equipment. This gives you a clear picture of what needs to be assessed.
• Identify manufacturer and component origins. Check each device against the list of restricted manufacturers. Remember that some cameras sold under compliant brand names may still contain components from banned manufacturers, so verify at the component level where possible. Manufacturer documentation and support teams can help confirm compliance status.
• Assess risk based on site use and data sensitivity. Not every camera may need immediate replacement. Prioritise cameras at sensitive locations, those connected to networks handling confidential data, and equipment on sites subject to government procurement rules.
• Plan a phased replacement. A complete system swap is rarely necessary all at once. Plan replacements in phases, starting with the highest-risk locations. When specifying new systems, consider whether hardwired or fixed CCTV or AI-enabled CCTV best suits the site. Understanding the different types of CCTV camera will help you select the right compliant equipment for each application.
• Document compliance for procurement records. Keep records of manufacturer compliance statements, component origin declarations, and your transition timeline. This documentation supports future audits and demonstrates due diligence to stakeholders.

Professional CCTV monitoring services can also be integrated during the transition to ensure continuous site protection while equipment is being upgraded.

Conclusion

NDAA compliance for security cameras is no longer a concern limited to US federal agencies. UK organisations across the public sector, critical infrastructure, and construction are increasingly expected to demonstrate that their surveillance systems do not rely on equipment from restricted manufacturers.

Taking a proactive approach to compliance protects your organisation from cybersecurity risks, supports data protection obligations, and positions you for any future regulatory changes. Whether you are planning a new CCTV installation or reviewing existing systems, understanding NDAA compliance should be part of the decision-making process.

For advice on specifying and installing NDAA-compliant CCTV systems, contact the Clearway team to discuss your site requirements.

FAQs

What are NDAA compliant security cameras?

NDAA compliant security cameras are surveillance devices that meet the requirements of Section 889 of the US National Defense Authorization Act by containing no components from banned manufacturers including Hikvision, Dahua, Huawei, Hytera, and ZTE. In simpler terms, they are cameras built entirely from components sourced outside of companies that the US government considers a national security risk.

Is Hikvision NDAA compliant?

Hikvision is not NDAA compliant. Hangzhou Hikvision Digital Technology Company is one of the five manufacturers specifically banned under Section 889 of the NDAA. In the UK, the government issued a directive in November 2022 to stop installing Hikvision cameras in sensitive government sites, though no formal ban applies to private organisations.

Does NDAA compliance apply in the UK?

NDAA compliance is not a legal requirement in the UK, as the NDAA is US federal legislation. However, the UK government directed departments to stop installing surveillance equipment from restricted Chinese manufacturers in sensitive sites in November 2022. UK organisations working with US federal agencies or contractors are also required to comply with Section 889.

Which security camera brands are NDAA compliant?

Several established manufacturers produce NDAA-compliant security cameras, including Axis Communications (Sweden), Bosch (Germany), Hanwha Techwin (South Korea), Avigilon (Canada), Mobotix (Germany), ACTi (Taiwan), and Vivotek (Taiwan). These companies design and manufacture their cameras without components from the five restricted manufacturers.

How do I know if my CCTV cameras are NDAA compliant?

To check if your CCTV cameras are NDAA compliant, identify the manufacturer and model of each device and cross-reference against the banned manufacturers listed in Section 889. Contact the manufacturer directly to confirm that no restricted components are used internally. A professional CCTV installer can also audit your existing system and advise on compliance status.

Written by Steve Hardcastle

Chief Technical Officer

View Steve’s LinkedIn profile More articles by Steve

Steve Hardcastle is Chief Technical Officer at Clearway, bringing extensive leadership experience from across the security sector, including the management of NSI and ACS-accredited businesses and the founding of Cerberus Security and Monitoring, which he led for over 25 years.

Working closely with Clearway’s research and development team, Steve helps shape the Group’s technical direction by identifying innovative technologies that enhance service capability, support operational performance, and provide a competitive advantage. His role includes developing technology strategies that support business growth, while also strengthening and evolving the Group’s existing product range.

Steve also provides technical and practical support across the wider business, working with sales, marketing, and operational teams on solution design, product positioning, implementation challenges, and day-to-day technical issues. His broad industry knowledge and hands-on approach play an important role in ensuring Clearway remains at the forefront of security technology and service innovation.