Telecommunications: Better Information Sharing Needed to Ensure Compliance with Foreign-Sourced Equipment Prohibitions

TL;DR

GAO found that Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 has reduced federal procurement from the five identified foreign telecommunications and surveillance companies since implementation in FY2019, with federal obligations to those companies declining through FY2025 and nearly zero spending in three fiscal years. As of March 2026, nearly 90% of companies with active government contracts in FY2025 publicly represented that they do not use equipment from those five companies. GSA (General Services Administration) and DOD maintain processes and search tools (including use of SAM representations and automated removal on GSA Multiple Award Schedule contracts) to enforce the prohibitions, but GAO found GSA and DOD are not broadly sharing implementation insights—such as subsidiary/affiliate mappings and supply-chain detection methods—with other agencies. GAO notes this information sharing gap could hinder compliance ahead of additional statutory prohibitions (for example, on semiconductors). Immediate implication: contractors in telecommunications, IT, surveillance, and related supply-chain roles must validate representations, document supply-chain provenance, and prepare for increased interagency scrutiny and information requests.

Key Points

• What happened: GAO reviewed implementation of Section 889 prohibitions and found reduced federal obligations to the five identified companies since FY2019, and that GSA and DOD have compliance processes but do not broadly share implementation insights with other agencies.
• Who is affected: Telecommunications, IT Services, Surveillance Equipment, Network Equipment, Information Technology, Cybersecurity, Supply Chain Security, Semiconductors, Communications Equipment; NAICS: 334220, 334290, 517311, 517312, 517410, 334111, 334118, 334210, 334310, 541512, 541513, 541519; Agencies: GSA, DOD; Contract vehicles: GSA Multiple Award Schedule / GSA MAS / FSS; Compliance surfaces: Section 889 (NDAA (National Defense Authorization Act) Section 889) and System for Award Management (SAM.gov (System for Award Management)).
• Timeline: Implementation began in fiscal year 2019; GAO analyzed obligations through fiscal year 2025 and reported findings as of March 2026.
• What contractors should do NOW: inventories of telecom/IT hardware and firmware, validate and document vendor representations in SAM, map subsidiaries/affiliates in supply chains, prepare written evidence of origin for components likely to be scrutinized, and configure Cabrillo Signals to detect solicitations and compliance inquiries tied to Section 889.

Who Is Affected

• Market segments: Telecommunications; IT Services; Surveillance Equipment; Network Equipment; Information Technology; Cybersecurity; Supply Chain Security; Semiconductors; Communications Equipment.
• NAICS codes (from segmentation): 334220, 334290, 517311, 517312, 517410, 334111, 334118, 334210, 334310, 541512, 541513, 541519.
• Agencies named: GSA, DOD.
• Contract vehicles named: GSA Multiple Award Schedule (GSA MAS / FSS).
• Compliance surfaces named: Section 889 (NDAA Section 889); System for Award Management (SAM.gov).

Specific NAICS codes, agencies, and contract vehicles beyond the above are pending source review.

Frequently Asked Questions

Q: What exactly did GAO find about federal spending with the five identified companies?

GAO found that after Section 889 implementation beginning in FY2019, agencies reduced spending with the five identified companies through FY2025, with zero spending in three of those fiscal years; GAO also reported that nearly 90% of companies with active FY2025 government contracts publicly represented they do not use equipment from those companies (as of March 2026).

Q: Do GSA and DOD have tools that help contracting officers check for compliance?

Yes. GAO reported GSA has automated processes to remove prohibited equipment and services on its Multiple Award Schedule contracts, and both DOD and GSA have search tools that contracting officers and purchase cardholders can use to determine contractor representations in the System for Award Management. GAO also noted GSA plans to expand use of customs data to identify origin of goods.

Q: Will other agencies get access to GSA/DOD implementation insights to help enforce future prohibitions?

GAO found GSA and DOD do not broadly share their implementation insights—such as subsidiary/affiliate information and supply-chain detection methods—with other agencies. Whether and how broader sharing will occur is pending source review.

Definitions

• Section 889: A prohibition in the John S. McCain National Defense Authorization Act for Fiscal Year 2019 that restricts federal agencies from procuring certain telecommunications and surveillance equipment and services from five identified companies and their affiliates, and from awarding contracts to companies that use such equipment and services.
• System for Award Management (SAM.gov): The government system where contractors make representations about compliance with procurement requirements; GAO noted DOD and GSA use SAM representations and search tools to assess compliance.
• GSA Multiple Award Schedule (GSA MAS / FSS): A set of GSA contract schedules used across government; GAO reported GSA has automated processes to remove prohibited equipment and services from these schedules.
• Waiver: A statutory mechanism noted by GAO that agencies could use to make awards after 2019 under certain conditions (GAO referenced past use of waivers).

Intelligence Response

• Cabrillo Signals War Room — Already detected this GAO event and delivered this briefing. War Room continuously monitors policy publications, GAO reports, and agency announcements to flag changes to compliance regimes such as Section 889 and related supply-chain prohibitions.
• Cabrillo Signals Match Engine — Automatically rescored opportunity pipelines to deprioritize bids at higher risk due to probable supply-chain noncompliance and to highlight opportunities where validated compliance offers a competitive advantage.
• Cabrillo Signals Intelligence Hub — Tracking affected agencies (GSA, DOD), named contract vehicles (GSA MAS / FSS), the listed NAICS codes, and saved searches on SAM.gov for follow-on solicitations, representations updates, and agency guidance related to Section 889.
• Proposal Studio (Proposal OS) and Proposal Studio Workflow Tracker — Use to accelerate compliant proposal submissions, generate compliance matrices for Section 889, manage the 9-gate capture workflow, and create audit-ready documentation of supply-chain attestations and due diligence.

Who to notify:

• Capture Lead — assess immediate impacts to current pursuits.
• Supply Chain Security Manager — confirm origin and vendor relationships for hardware/firmware.
• Proposal Manager — update compliance matrices and bid/no-bid decisions.
• Contracts/Legal — prepare responses to potential agency inquiries and attestations.

First 48-hour playbook:

• Hour 0–4: War Room alert — validate receipt of this briefing. Capture Lead and Supply Chain Security Manager run a priority inventory of active bids and contracts against the NAICS list and GSA MAS awards.
• Hour 4–12: Use Cabrillo Signals Match Engine to rescore active pipeline and surface high-risk opportunities; deploy Intelligence Hub saved searches for any new SAM updates or agency notices mentioning Section 889.
• Hour 12–24: Proposal Manager and Compliance review supplier attestations and SAM representations; generate initial compliance matrix in Proposal Studio; document gaps and mitigation plans.
• Hour 24–48: Produce audit-ready evidence packages in Proposal Studio Workflow Tracker for top-priority opportunities and current awards; brief BD leadership and Legal; set recurring War Room monitoring and Intelligence Hub alerts for follow-up GAO/agency guidance.

Relevant Cabrillo guides: Winning Federal Contracts Guide (/insights/winning-federal-contracts). For control and compliance support see CMMC (Cybersecurity Maturity Model Certification) Compliance Guide (/insights/cmmc-compliance-guide) and CUI (Controlled Unclassified Information)-Safe CRM Guide (/insights/cui-safe-crm-guide).