| NDAA Section 889 / covered equipment |
Determine whether the proposed equipment or services are covered by the applicable U.S. federal procurement restrictions. Assess the exact manufacturer, product, components, and use case; do not treat country of manufacture alone as a complete compliance test. |
Written, model-specific compliance representation; bill-of-materials or supply-chain information where available; applicable contract representations; and procurement counsel’s review of the solicitation and rules. |
For U.S. federal contracting, confirm the product and relevant services meet the contract’s requirements and that required representations are accurate. Escalate uncertainty for legal or contracting review. |
Section 889 of the FY2019 NDAA and the FAR restrict specified federal procurement and certain contracting with entities that use covered telecommunications or video-surveillance equipment or services. Applicability depends on the provision and circumstances. |
| Secure boot and signed firmware |
Check whether the camera verifies firmware authenticity and integrity during installation and startup, and whether unauthorized firmware can be rejected. |
Security documentation describing secure boot, firmware-signing, signature-validation, and recovery behavior; test results or a product security guide. |
Prefer documented signature verification and a controlled recovery process. Treat unsigned or unverifiable firmware updates as a significant risk. |
Authenticity and integrity controls help reduce the risk of unauthorized software being installed or run on a device. |
| Firmware support and end-of-life policy |
Confirm the published support period, security-update process, end-of-sale and end-of-support notices, and how customers are notified of critical issues. |
Product lifecycle policy; supported-model list; firmware release history; security advisory archive; and a written support commitment for the purchased model. |
Choose a model with a clearly stated support horizon that covers the planned service life. Avoid products whose update availability or end-of-support date cannot be established. |
Networked cameras need security maintenance after deployment; an unsupported device may remain exposed to vulnerabilities without a vendor-provided fix. |
| Vulnerability disclosure and response |
Look for a public vulnerability-reporting channel, a coordinated disclosure process, security advisories, and a method for receiving urgent notices. |
Product security page or vulnerability disclosure policy; published advisories; incident-response contacts; and documented remediation communications. |
Verify that a security report can be submitted and tracked, and that advisories identify affected models, firmware versions, mitigations, and fixes where applicable. |
A defined reporting and response process helps customers assess and manage newly discovered product vulnerabilities. |
| Account and access security |
Assess unique credentials, password-change controls, role-based permissions, account lockout or rate limiting, and support for centralized authentication where required. |
Administration guide; configuration screenshots or test access; supported authentication protocols; and documentation of default-account behavior. |
Reject deployments that require shared default credentials or cannot disable unnecessary accounts. Confirm administrators can apply least-privilege access. |
Strong authentication and access control reduce the likelihood and impact of unauthorized administration. |
| Encryption and secure communications |
Identify which connections can use encrypted transport, how certificates are managed, and whether insecure services or protocols can be disabled. |
Network and protocol documentation; configuration guide; supported TLS versions and certificate options; and a port/service inventory. |
Confirm management and video paths can be protected in the intended network design, and disable unneeded services and plaintext interfaces. |
Encryption can help protect credentials and data in transit, while reducing exposed services limits the attack surface. |
| Privacy and data handling |
Determine what data the camera and associated software collect, where it is stored or transmitted, retention controls, and whether cloud functions are optional. |
Data-flow diagram; privacy and retention documentation; cloud-service terms; and configuration options for analytics, telemetry, and remote access. |
Ensure data flows and retention settings match organizational policy and applicable law. Disable optional collection or remote services when they are not needed. |
Understanding data collection and transmission supports privacy, records-management, and deployment-risk decisions. |
| Standards and baseline capabilities |
Compare documented device capabilities with recognized IoT cybersecurity guidance, such as device identification, secure configuration, data protection, interface access control, secure software updates, and cybersecurity-state awareness. |
Product security specifications mapped to NISTIR 8259A or other applicable requirements; independent assessment reports where available. |
Request a capability-by-capability mapping rather than relying on an unsupported “secure” or “certified” claim. Treat NIST guidance as a reference unless the contract makes it mandatory. |
NISTIR 8259A describes a core baseline of cybersecurity capabilities for IoT devices; it is a useful comparison framework, not a product certification by itself. |
| Interoperability and protocol support |
Verify compatibility with the organization’s video management system and required standards or protocols, including the exact features needed for the deployment. |
Current compatibility list; integration documentation; conformance or interoperability test results; and a proof-of-concept using the proposed firmware. |
Test recording, playback, event handling, time synchronization, and credential management with the intended system before large-scale purchase. |
Compatibility can vary by model, firmware, and feature; a standards reference alone does not guarantee every integration function. |
| Supply-chain and product transparency |
Assess whether the manufacturer can identify product versions, component changes, security dependencies, and relevant manufacturing or support relationships. |
Product change-notification process; available software bill of materials (SBOM); component and dependency information; and documented supply-chain risk practices. |
Prefer clear change notices and traceable model/firmware identifiers. Record the exact hardware revision and software version evaluated. |
Traceability helps organizations evaluate vulnerabilities, manage product changes, and maintain accurate asset inventories. |
| Lifecycle and operational management |
Check centralized configuration, inventory, logging, time synchronization, backup and restore, and secure decommissioning options. |
Administration and deployment guides; supported management interfaces; sample logs; and instructions for factory reset and credential/data removal. |
Confirm the camera can be monitored, patched, and securely retired using the organization’s operational processes. |
Security depends not only on device design but also on maintainable deployment, monitoring, and retirement practices. |
