View all articles | Read the next article | Take the CCB CEU quiz

Section 889 of the Fiscal Year 2019 National Defense Authorization Act completely changed the landscape of federal contracting.1 What many first dismissed a narrow ban on specific telecommunications equipment ended up exposing deep cracks in how organizations manage vendor compliance and supply chain integrity. When the Federal Acquisition Regulation (FAR) clauses 52.204-24, -25, and -26 went into effect, the initial reaction across industry was frantic: scrambling to update templates, issuing vendor memos, and adding checkboxes for certification. But Section 889 wasn’t just another compliance requirement; it was a wake-up call. It reminded contractors that compliance isn’t something you add at the end; it starts in the contract itself.

Section 889 didn’t simply outlaw certain technologies; it forced organizations to rethink how ethics, accountability, and national security expectations are baked into every agreement they sign.

Why Section 889 matters

The law is deceptively short but incredibly far-reaching. It prohibits the federal government from buying or working with any company that uses or provides covered telecommunications or video surveillance equipment or services from specified Chinese manufacturers, such as Huawei Technologies Company and ZTE Corporation.2

Section 889 has two key parts:

◆ Part A bans federal agencies from directly procuring from covered entities. 

◆ Part B goes further, forbidding contractors themselves from using such equipment anywhere

in their operations, even outside of federal work.3

Those requirements are implemented through FAR 52.204-25 and FAR 52.204-26, both of which push responsibility down the supply chain. Contractors must certify compliance and ensure their vendors do the same.

Unlike many rules that rely on government oversight, Section 889 depends on self-certification. A single false statement can lead to termination, penalties under the False Claims Act, and lasting reputational damage.

In other words, Section 889 made compliance a contractual condition, not a check-the-box activity. It pushed compliance professionals, procurement officers, and legal teams to start talking to one another in new ways, and fast.

Building a contract-based compliance program

When Section 889 hit, most companies instinctively looked to IT or procurement for answers. But the real power to manage risk was sitting in plain sight: the contracts themselves.

At my organization, we decided early on to treat contracts as our compliance framework. Every clause would serve a purpose; every certification would have a home.

1. Template redesign

We reworked all prime and subcontract templates to include the updated FAR 52.204-25 clause. Nothing moved forward until the correct version was embedded. That made compliance the default, not an afterthought.

2. Vendor certifications

We created a standardized 889 certification form. We tracked certifications at the contract signature stage and blocked awards if certifications weren’t on file. We also required certifications at the solicitation stage.

3. Flow-down control

Subcontract templates were revised to require the same level of compliance from every lower-tier vendor. The goal was consistency: one clause, one standard, all the way down.

4. Internal coordination

Contracts, compliance, IT, and leadership teams met regularly to align processes. Any purchase request automatically triggers a cross-check against restricted entities. We stopped treating Section 889 as a legal issue and started treating it as a shared responsibility. We also introduced a tracker of Section 889 compliance per company and country, incorporating internal and cell phone service providers.

5. Strengthened audit rights

We expanded our right-to-audit clauses to allow verification of vendor certifications and terminate for cause if false statements surfaced. That clarity deterred shortcuts.

Lessons from the rollout

Rolling out Section 889 wasn’t easy. It challenged every assumption about how “compliance” fits into the business.

What worked

◆ A single clause library ensured that every template matched the latest FAR text. 

◆ Vendor training replaced fear with understanding, emphasizing why the rule existed rather than just what it required. 

◆ Shared databases helped procurement, IT, and compliance stay aligned on vendor status. 

What didn’t

◆ Some vendors felt overwhelmed by yet another certification demand. 

◆ Legacy templates caused inconsistencies that took time to fix. 

◆ Early teams treated 889 as a one-and-done project instead of an ongoing process. 

The takeaway? Compliance isn’t a file you maintain; it’s a behavior you model. Contracts just make that behavior enforceable

Table 1: Compliance through contract lifecycle

A lifecycle approach to contract compliance

True compliance follows the life of the contract. It starts before award and doesn’t end until closeout (see Table 1 on page 13).

This structure works beyond Section 889. Anti-corruption, privacy; they all depend on the same principle: design compliance into the contract, and you control the outcome.

The future of contract governance

Section 889 proved that compliance and contracting can’t operate in silos. As new requirements emerge, like the Cybersecurity Maturity Model Certification 2.0 or supply-chain resilience mandates under Executive Order 14,017, the same lesson applies.4

Organizations that thrive will make three shifts:

1. Integration: Compliance professionals must have a seat at the contracting table. Clause development, risk vetting, and vendor oversight should be shared responsibilities. 

2. Technology: Modern contract lifecycle management tools 

aren’t just repositories; they’re compliance engines. Use them for real-time tracking, alerts, and reporting to prevent lapses before they happen.

3. Culture: Every clause tells a story about your ethics. A contract isn’t just a legal document; it’s your organization’s values in writing.

Section 889 compliance checklist

Use this quick self-audit to gauge your readiness:

◆ All templates include FAR 52.204-25 and flow-down requirements. 

◆ Annual vendor certifications are collected, tracked, and verified. 

◆ Restricted entity lists are current and integrated into procurement workflows. 

◆ Reporting and remediation procedures are documented and enforced. 

◆ Audit rights include certification verification and clear termination language. 

◆ Lessons learned inform updates to templates and training annually. 

Conclusion: Compliance by design

Section 889 taught the industry that you can’t bolt compliance onto a bad contract. Once signatures are in place, your leverage evaporates.

The real work happens upfront when you write, negotiate, and execute agreements that make compliance unavoidable. Organizations that built Section 889 into their contracts didn’t just meet the rule; they strengthened their integrity.

The next generation of compliance won’t come from new regulations; it will come from better contracts.

Because at the end of the day, the contract is the source code of compliance.

Endnotes

1. Aquistion.gov, “Section 889 Policies,” accessed January 14, 2026, https://www.acquisition.gov/Section-889-Policies.

2. 41 U.S.C. § 3901 (2018), https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title41 section3901&num=0&edition=prelim .

• 3. Aquistion.gov, “52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment,” accessed January 14, 2026, https://www.acquisition.gov/far/52.204-25. 
• 4. America’s Supply Chains, Executive Order No. 14017, 86 Fed. Reg. 11,849 (February 24, 2021), https://www.federalregister.gov/documents/2021/03/01/2021-04280/americas-supply-chains . 

Takeaways

◆ Section 889 transformed compliance from a policy exercise into a contractual obligation embedded in every stage of vendor and supply-chain management. 

◆ Successful Section 889 programs rely on redesigned contract templates, standardized certifications, and continuous vendor monitoring rather than one-time attestations. 

◆ Compliance effectiveness depends on collaboration among contracts, IT, and compliance teams to align risk assessment, data verification, and enforcement mechanisms. 

◆ Weak or outdated contract clauses are the primary failure point for compliance breaches, underscoring the need for precise, enforceable language. 

◆ Future compliance success will hinge on treating contracts as living governance tools supported by automation, analytics, and integrated organizational ownership. 

View all articles       Read the next article