Yes — Milestone Systems and its XProtect video management software (VMS) are not affected by the NDAA Section 889 ban. Milestone is a Danish company (headquartered in Brøndby, Denmark, and part of Canon Group), so it is not one of the five covered entities named in Section 889 — Hikvision, Dahua, Huawei, ZTE, or Hytera — nor an affiliate or rebrand of any of them.
The important distinction for federal buyers: XProtect is software that manages cameras and recorders; it does not, by itself, create a Section 889 problem. The compliance risk in a Milestone deployment lives in the hardware you connect to it — the cameras, recording servers, and network gear. A compliant VMS paired with banned cameras is still a non-compliant system.
Why Milestone XProtect clears NDAA Section 889
NDAA 2019 Section 889 — implemented in federal contracts through FAR 52.204-25 — prohibits federal agencies and contractors from procuring or using covered telecommunications and video-surveillance equipment from Hikvision, Dahua, Huawei, ZTE, and Hytera, along with their subsidiaries, affiliates, and OEM rebrands. Milestone Systems is a Danish software vendor with no ownership, affiliation, or component relationship to any covered entity. XProtect is an open-platform VMS, not a camera or recorder, so the brand itself does not appear on any covered list.
That makes XProtect a sound foundation for federal video surveillance. But because XProtect is hardware-agnostic by design — its strength is supporting thousands of third-party devices — the burden shifts to verifying every camera, encoder, and recording appliance bound to it.
VMS compliance vs. the hardware behind it
A video management system can be perfectly compliant and still anchor a system that fails an audit. Section 889 compliance is determined per bill of materials. If XProtect is recording from Hikvision or Dahua cameras — or from rebranded covered hardware sold under names like Lorex, EZVIZ, Uniview, Annke, or LTS — the deployment is non-compliant and subject to rip-and-replace, regardless of how clean the VMS is.
For a federal-grade XProtect build, every connected camera and recorder must be verified as NOT manufactured by a covered entity AND free of covered components such as Huawei/HiSilicon system-on-chips. Compliance is per-SKU: a single brand can ship both compliant and non-compliant models, so the specific model number on the line is what matters.
Compliant camera and recorder lines we commonly pair with XProtect include Axis Communications, Hanwha Vision (Wisenet), i-PRO, Bosch, Avigilon and Pelco (Motorola Solutions), Digital Watchdog, VIVOTEK, Speco Technologies, and MOBOTIX. On the recording side, XProtect runs on standard servers and purpose-built NVR appliances from these same compliant manufacturers — again, verified by model.
NDAA is not the same as TAA
For GSA and many federal contracts, a second rule applies. The Trade Agreements Act (TAA, 19 U.S.C. 2501) is a country-of-origin requirement: the product must be made or substantially transformed in the United States or a TAA-designated country. China, Russia, and India are not designated countries. TAA is separate from Section 889 — a product can be NDAA-compliant yet not TAA-compliant, or vice versa.
Milestone is headquartered in Denmark, a TAA-designated country, which positions XProtect well for TAA-sensitive procurements. As with hardware, the precise compliance posture of any given software and appliance package should be confirmed against the contract clauses in your solicitation rather than assumed.
How Uniqcli sources and documents compliant XProtect systems
Uniqcli is a TAA / NDAA Section 889-compliant physical-security integrator. We design, integrate, and manage XProtect deployments and sell direct — no purchase up front. Because we are vendor-neutral, we select the right compliant camera and recorder line for the mission rather than pushing a single label, and we confirm the NDAA 889 and TAA posture of every component before it reaches your site.
For contracting officers and audit teams, we provide the documentation that proves the system holds together: manufacturer attestations, country-of-origin detail, and a verified bill of materials covering the VMS, cameras, servers, and network hardware. That closes the gap that trips up most XProtect projects — a compliant platform undermined by unverified devices.
If you are standing up, expanding, or remediating an XProtect environment for a federal, DoD, SLED, healthcare, or critical-infrastructure site, request a quote or schedule a compliance assessment with Uniqcli. We will confirm your full system meets Section 889 and TAA requirements and hand you the paperwork your contracting and security teams need.
