RESOURCES · SECURITY CAMERAS
What is NDAA for security cameras and why does it matter in Guatemala?
The NDAA is a US law that restricts certain video surveillance manufacturers. It does not apply legally in Guatemala, but it matters for companies with ties to the US and for anyone taking supply chain seriously.
The NDAA (National Defense Authorization Act) is a US federal law. Its Section 889 restricts the use of video surveillance and telecommunications equipment from certain manufacturers — primarily Hikvision, Dahua, Hytera, Huawei, and ZTE — for US federal agencies and their contractors, due to national security and supply chain concerns.
Does this law apply in Guatemala? Not directly as law. The NDAA does not bind private Guatemalan companies. But it matters for two practical reasons: first, if your company has a parent, clients, contracts, or supply chain tied to the US, NDAA compliance can become a commercial requirement imposed by the counterparty. Second, the security reasons behind the NDAA — risk of firmware under foreign control, backdoors, supply chain opacity — apply equally to any company in any country.
This article is prepared by E3 Solutions, distributor and installer of Bolide cameras (US manufacturer, NDAA-compliant) in Guatemala. We explain what the law says, which manufacturers are restricted, how to identify an NDAA-compliant camera, and what options you have in the Guatemalan market.
If you are already comparing NDAA camera options: see the E3 Bolide camera system → /camaras-de-seguridad
What is the NDAA?
The National Defense Authorization Act for Fiscal Year 2019, John S. McCain is the annual US defense law signed on August 13, 2018. It is a broad legislative package covering military budget, federal procurement, and technology policies, among many other topics. The piece that has a direct impact on the video surveillance industry is only its Section 889: the section that restricts which equipment US federal agencies and those who contract with them may acquire and integrate. The rest of the law does not affect the CCTV industry. When the electronic security sector talks about "NDAA compliance" or "NDAA-compliant," the specific reference is always to this section. It is worth understanding this so as not to overstate or understate the scope of the law.
What is Section 889?
Section 889 prohibits US federal agencies and their contractors from acquiring, using, or integrating video surveillance and telecommunications equipment produced by five companies and their subsidiaries: Huawei Technologies Company, ZTE Corporation, Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, and Dahua Technology Company. The formal reason is national security and supply chain concerns: the risk that the firmware or hardware of this equipment may contain vulnerabilities — intentional or not — that could represent a vector for unauthorized access. At the regulatory level, the FCC (Federal Communications Commission) issued an order in November 2022 that prohibits the authorization of new Hikvision and Dahua equipment for sale in the US; that order was confirmed on appeal in April 2024. An important clarification: Section 889 applies to the US federal government and to those who contract directly with it. It is not a universal ban on these brands for private use in the US or in any other country.
Does this matter in Guatemala?
For a private company or household in Guatemala, the NDAA is not a legal obligation. No one will fine you for installing Hikvision or Dahua cameras in your business. But the conversation changes in four scenarios:
Companies with ties to the US
Maquilas with a US parent company, exporters to the US market, franchises of American brands, regional offices of multinationals, contractors on projects funded with US funds, and non-governmental organizations funded by agencies such as USAID or similar. In all these cases, NDAA compliance can become a commercial requirement imposed by the parent, client, or funder. It is not Guatemalan law that compels: it is the US counterparty that requires it as a condition of the contract or commercial relationship. Being NDAA-compliant up front removes that friction.
Companies with international compliance audits
Frameworks such as ISO 27001, SOC 2, or alignment with NIST cybersecurity standards do not literally require NDAA compliance. However, all of them include supply chain risk management as a principle. A company moving toward those certifications will find that choosing NDAA-compliant equipment is the concrete, verifiable answer to the question: "what are you doing to manage supply chain risk in your security infrastructure?"
Critical infrastructure operators
Banking, telecommunications, energy, water, healthcare, and logistics are sectors where a compromised camera can become an attack vector that goes far beyond the video image. Even in Guatemala, where there is no legal obligation on this, installing equipment from manufacturers with an auditable supply chain and verifiable firmware is basic prudence for any operator of sensitive infrastructure.
Everyone else
For the average business, the condominium, or the residence, the technical reasons behind the NDAA apply equally: firmware without backdoors, a transparent supply chain, and reliable security support and updates. There is no legal obligation, but there is a real benefit. Stated plainly: we are not claiming that Hikvision or Dahua actively spy on your business. We are pointing out that the opacity of their firmware and the concentration of their supply chain are risks that serious regulators have quantified and decided to restrict. Bringing that risk into your site is a conscious decision every company has the right to make; ignoring it is not neutral either.
How do I identify an NDAA-compliant camera?
Not every camera from a non-Chinese manufacturer is automatically NDAA-compliant. Before buying, verify the following:
- The manufacturer publishes a formal NDAA compliance statement, with specific reference to Section 889. A generic statement saying "we comply with applicable regulations" is not enough.
- The specific product (SKU) is listed as NDAA-compliant. Some brands have mixed lines — there are compliant and non-compliant models within the same brand. Compliance applies by SKU, not by brand.
- The manufacturer is not a subsidiary or OEM of Hikvision, Dahua, Huawei, ZTE, or Hytera. There are brands on the market that are rebrands of Chinese equipment from the restricted manufacturers; Section 889 also reaches subsidiaries and derivative products.
- Third-party audits or additional certifications such as TAA-compliant or alignment with FedRAMP are additional indicators of maturity in supply chain risk management.
Bolide publishes its NDAA-compliant lines explicitly — see catalog → /camaras-de-seguridad/catalogo
NDAA-compliant brands available on the market
NDAA compliance is not exclusive to a single brand. Brands with a compliance statement that are commonly cited in the electronic security industry include: Bolide, Hanwha (formerly Samsung Techwin), Avigilon (part of Motorola Solutions), Axis Communications, VIVOTEK, FLIR, Verkada, i-PRO (formerly Panasonic), Honeywell, Pelco, and March Networks, among others. Not all of these brands have active local distribution in Guatemala; availability and support vary depending on the distributor present in the country. E3 Solutions distributes and installs Bolide because it combines NDAA compliance with the iPac AI analytics platform — facial recognition, license plate recognition (LPR), perimeter intrusion, people counting, heat map, and other functions — at a commercial cost suitable for the Guatemalan market.
If you are just deciding which base technology to use for your system, also read IP vs analog cameras: which to choose → /recursos/camaras-ip-vs-analogicas-cual-elegir
Bolide and the NDAA
Bolide Technology Group is a CCTV systems manufacturer based in San Dimas, California, USA. Its iPac AI 5MP NDAA and iPac AI 4K NDAA lines are explicitly NDAA-compliant; SKUs with the `/NDAA` suffix are listed as specifically compliant for procurement environments that require it. Bolide also offers TAA-compliant lines for US federal government contractors that must meet the Trade Agreements Act in addition to Section 889. In Guatemala, E3 Solutions is the distributor and installer of Bolide: installation by certified technicians, 3-year warranty on the equipment, and 24/7 support for emergency situations.
See the Bolide camera system at E3 Solutions → /camaras-de-seguridad
Conclusion
The NDAA is not law in Guatemala, and this article does not claim otherwise. But the reasons that led the US government to restrict those manufacturers — auditable supply chain, verifiable firmware, alignment with good security practices — are valid reasons for any company, regardless of jurisdiction. For businesses with a direct relationship to the US or with international compliance audits, NDAA compliance is in practice a requirement. For everyone else, it is well-founded prudence.
If you are just deciding between IP and analog cameras, read the comparison → /recursos/camaras-ip-vs-analogicas-cual-elegir
Frequently asked questions
Want an NDAA-compliant proposal for your site?
We quote NDAA-compliant Bolide cameras with installation by certified technicians, a 3-year warranty, and 24/7 support in Guatemala.