NDAA 889 PROHIBITED MANUFACTURERS
The National Defense Authorization Act (NDAA) prohibits the use of equipment manufactured by a limited set of manufacturers.
Please read this page for details on how to work with the Information Security Office (ISO) to discontinue the use of products from banned manufacturers.
PROHIBITED MANUFACTURERS
ISO strives to maintain a list of prohibited manufacturers; however, the federal government adds companies on a continuing basis. Please consider the list below to be provisional, as it may be over- and under-inclusive in some respects. UC Riverside personnel are responsible, at the time of equipment purchase, to refer to the list and ensure the manufacturer has not been added.
Contact infosecoffice@ucr.edu if you’re unsure or have other questions.
Huawei Technologies Company
↓
ZTE Corporation
↓
Currently identified subsidiaries/affiliates of Hytera Communications Corporation, Hangzhou Technology Company, or Dahua Technology Company
↓
Hangzhou Hikvision Digital Technology Company
↓
Hytera Communications Corporation
↓
Background
Beginning in 2019, The National Defense Authorization Act (NDAA) introduced prohibitions on the use of equipment manufactured by a limited set of manufacturers.
2020 Update: More Manufacturers Added
This set of companies was expanded in the most recent 2020 NDAA. A list of banned companies is provided below.
Why NDAA Compliance Matters: Effects on Funding
Any organization acting as a contractor for any federal agency must comply with this prohibition in order to receive any funding from the federal government.
This prohibition is not limited to programs that perform contracted work, but to UC Riverside’s entire enterprise. A UC systemwide memo on this matter has been published by the Office of the President at: https://researchmemos.ucop.edu/index.php/site/memoDetail/memo_id/RPAC-20-05.
Your Role: Work with OIA to Discontinue Use of Prohibited Equipment
Everyone at UC Riverside has a role to play to ensure prohibited equipment is not used on campus networks or procured by the University. Please refer to the NDAA Guidance for Campus Units page to review the Campus Compliance Plan, which outlines roles and responsibilities.
The Information Security Office (ISO) uses information drawn from network management data to identify equipment on the UC Riverside network in violation of this prohibition. When identified, the individual responsible for the equipment will be contacted and a remediation plan developed. In general, such equipment must be promptly removed from the network.
If you are using equipment manufactured by any of the prohibited companies, please contact us immediately before removing it. The regulations can be difficult to interpret and we can assist in the determination of whether your equipment is covered.
For assistance please contact infosecoffice@ucr.edu
Additional Information
- This prohibition extends to the use of cell phones manufactured by the prohibited vendors for university business. This is primarily significant for staff members using Huawei phones. These may not be used for university business.
- Video surveillance or security cameras are explicitly mentioned in the NDAA. Please consider this when purchasing any new video equipment.
- In addition, the use of Kaspersky software, a common producer of commercial anti-virus software, has been prohibited since 2017. In order to ensure continued compliance, in January the campus will implement a network block preventing updates to Kaspersky servers from taking place.
Additional Resources
- https://www.getscw.com/knowledge-base/the-ban
- https://researchmemos.ucop.edu/index.php/site/memoDetail/memo_id/RPAC-20-05.
- https://www.nytimes.com/2020/02/19/business/huawei-us-court.html
- https://www.federalregister.gov/documents/2020/07/14/2020-15293/federal-acquisition-regulation-prohibition-on-contracting-with-entities-using-certain