FCC Supply Chain Security Rules

Prohibitions on telecommunications equipment from companies posing national security risks.

JurisdictionUnited States
CategoryTelecommunications
StatusActive
Latest development

Analysis

Key Requirements

  • Prohibition on Use of Covered Equipment and Services Telecommunications carriers and service providers are prohibited from using equipment or services produced or provided by companies deemed to pose a national security risk, as identified on the FCC’s “Covered List.” This includes major Chinese manufacturers such as Huawei and ZTE. FCC Covered List Overview FCC Equipment Authorization Program

Compliance Challenges

  • Legacy Equipment Exposure Many rural and smaller providers still operate legacy equipment from banned vendors, which remains a security risk due to cost and logistical challenges of replacement. For example, Huawei equipment is still widely deployed in rural America, sometimes near sensitive military sites. FDD Analysis: Legacy Equipment Risks FCC Equipment Authorization Gaps

Implementation Best Practices

Recent Updates

  • 2025: New Cybersecurity and Risk Management Plan Requirements The FCC issued a declaratory ruling (effective January 2025) and proposed new rules requiring annual certification of cybersecurity and supply chain risk management plans, with a 12-month implementation period for large providers and 24 months for small providers. FCC Cybersecurity Rule Announcement FCC Proposed Rulemaking Details

Related Regulations

  • Communications Assistance for Law Enforcement Act (CALEA) Requires telecom carriers to ensure lawful interception capabilities and now explicitly mandates network security measures under Section 105. CALEA Overview FCC Declaratory Ruling on CALEA
  • Secure and Trusted Communications Networks Act Directs the FCC to publish and maintain the Covered List and prohibits federal funds from being used to purchase or maintain covered equipment. FCC Secure Networks Act Implementation
  • NIST Cybersecurity Framework Provides a voluntary framework for organizations to manage and reduce cybersecurity risk, referenced in FCC guidance for compliance. NIST Cybersecurity Framework
  • Bureau of Industry and Security (BIS) Export Controls BIS rules on export controls for certain technologies influence FCC’s Covered List and supply chain security determinations. BIS Export Administration Regulations

Industry Impact

  • Increased Compliance Costs and Operational Burden Providers, especially rural and small carriers, face significant costs to replace prohibited equipment and implement new security controls, sometimes threatening service continuity. FDD Industry Impact Analysis FCC National Security Measures

Sources

Recent developments

  • — FCC Federal Register publication of its Supply Chain Security Equipment Authorization **Final Rule** under the Secure Networks Act, tightening the FCC’s supply chain security rules by clarifying that Covered List items include modular transmitters, prohibiting authorization of devices that include such covered modules, and establishing new procedures to limit continued marketing/import of previously authorized covered equipment[5][2]. (source)
  • — Industry summary notes the FCC’s Supply Chain Security Equipment Authorization **Final Rule** will take effect, detailing that it (1) confirms Covered List status for modular transmitters, (2) bans authorization of devices containing covered modular transmitters, (3) creates a process for OET and PSHSB to restrict marketing/import of already authorized covered gear, and (4) broadens the interpretation of “produced by” in Covered List entries[2]. (source)
  • — Nextgov reports the FCC voted to **reverse a prior telecom cybersecurity rulemaking** tied to CALEA that would have imposed explicit cybersecurity obligations on carriers, with the majority arguing the earlier approach was unlawful and overly burdensome and instead emphasizing collaborative, non-mandatory efforts to harden networks[3]. (source)
  • — FCC published Final Rule on Supply Chain Security Equipment Authorization, clarifying Covered List scope for modular transmitters, prohibiting devices with them, enabling limits on prior authorizations, and expanding "produced by" definition; rule takes effect soon (source)
  • — Mintz reports the FCC adopted on October 28, 2025 a **Second Report and Order and Second Further Notice of Proposed Rulemaking** to further secure the communications supply chain, including clarifying that covered equipment includes modular transmitters, reinforcing prohibitions on authorizing such modules or devices containing them, and seeking comment on extending prohibitions to other component parts like semiconductors, firmware, and optical transceivers[1]. (source)
  • — FCC adopted Second Report and Order clarifying Covered List includes modular transmitters, prohibiting their authorization, and Second Further Notice seeking comments on expanding to components like semiconductors and strengthening enforcement against online resellers (source)
  • — Senate passed Foreign Adversary Communications Transparency Act requiring FCC to publish list of licensees linked to China, Russia, Iran, North Korea; bill now awaits House action (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates