A mobile tower is more than a collection of antennas. Behind it sits a chain of radios, routers, software, fiber connections, management systems, and suppliers that makes everyday communication possible. The same infrastructure that carries a hospital's call or a factory's order can also expose sensitive information if an attacker gains control. That is why buying telecom equipment in the United States has become a national-security question as well as a decision about price and performance.

The most useful starting point is a distinction often lost in headlines: U.S. telecom security policy is not one universal equipment ban. Rules about FCC authorization, importing and selling devices, federal contracts, replacement funding, and defending an operating network answer different questions. A product can have an old FCC authorization yet face a later sales restriction. A company can have a federal-contract problem even when the equipment involved is not used for that contract. And choosing an eligible supplier does not, by itself, make a network secure.

As of October 26, 2026, the policy picture also extends beyond the familiar debate about Huawei and ZTE. The FCC has added foreign-produced routers to its Covered List with a conditional-approval exception, and a new component-level authorization rule became effective October 13. Those developments make the exact device, supplier, production history, and intended transaction more important than a brand name alone. This explainer separates those changes from proposals and from the practical work of protecting a network.

What counts as telecom equipment—and why control matters

Telecom equipment includes cellular base stations and radios, the routers that direct traffic, optical transport systems that move data over fiber, and equipment that connects a home or business to a provider. Networks also depend on authentication, signaling, monitoring, and remote-administration systems. A vulnerability in a management interface can be consequential even when the equipment is physically locked inside a secure facility.

The concern is not simply whether a device comes from another country. Security analysis asks who designed it, who can change its software, which organizations have administrative access, how updates are authenticated, and whether the operator can investigate abnormal behavior. Supply-chain compromise, stolen credentials, vulnerable software, and misconfigured access controls are different routes to a similar outcome: someone other than the operator gaining influence over communications.

Sensitive information is not limited to the content of a conversation. Call records and other metadata can reveal relationships and patterns of activity. Interference with routing or network availability can disrupt services even without reading a message. Equipment choices therefore matter to confidentiality, integrity, and availability—the ability to keep information private, trustworthy, and usable when needed.

The FCC Covered List is the starting point, not the whole answer

The FCC Covered List identifies equipment and services deemed to pose an unacceptable risk under the Secure and Trusted Communications Networks Act. The FCC maintains the list using determinations from the sources specified by law. The page reviewed for this article carried an October 23, 2026 date. Huawei and ZTE telecom equipment were among the entries first included March 12, 2021; other entries have different wording and use-based qualifications. Read the actual entry rather than assuming every device sold by every named business has the same legal treatment.

The FCC's equipment-authorization rules prohibit authorization of covered equipment. Authorization is part of the legal framework for many radio-frequency devices entering the U.S. market; it is not a comprehensive cybersecurity certification. A device having an FCC ID does not mean the federal government has verified every security feature, every firmware release, or every supplier relationship. Conversely, a new Covered List designation does not, on its own, answer whether all previously purchased devices must be switched off.

For a purchaser, the useful questions are specific: What is the exact model and FCC ID? Who actually produces it? Is that device within a Covered List entry? Is the proposed sale or import permitted? Are there applicable exceptions or approvals? An old certificate or a retailer's reassuring product description is not a substitute for checking current restrictions.

The 2026 router change reaches beyond vendor nationality

On March 23, 2026, the FCC announced the addition of routers produced in foreign countries to the Covered List, except routers granted a Conditional Approval by the relevant national-security departments. The official notice, DA 26-278, explains that this is a production-location-based designation, not a list of individual companies. It says the underlying determination applies regardless of the producer's nationality. An American brand name therefore does not, by itself, settle the authorization question.

The notice connects the addition to the existing prohibition on new authorizations for covered equipment and describes a process for conditional approvals. It also distinguishes location-based entries from rules that apply to entities individually identified on the Covered List. That distinction matters elsewhere in the FCC framework: a rule aimed at an identified producer should not automatically be applied to every producer caught by a location-based category.

Consumers should not translate this into a claim that every foreign-made router already in a home must be disconnected. Authorization for a new device, sale of an already-authorized model, and continued operation are separate issues. Businesses placing orders should check the current list, the specific authorization, and any current conditional approval instead of assuming either that all foreign production is exempt or that every existing device is unlawful. This article does not attempt a model-by-model eligibility catalogue.

Already-authorized equipment can face new sales restrictions

Earlier authorization is not always a permanent passport to the market. In its June 26, 2026 notice DA 26-635, the FCC prohibited continued importation and marketing of specified previously authorized covered equipment added to the list in 2024 or earlier. The notice expressly distinguished those restrictions from continued use or operation of already-purchased equipment and excluded equipment added in 2025 or 2026 from that particular action.

The notice also included timing and a temporary suspension for certain critical-infrastructure surveillance uses while a revised definition was pending. Those details are a reason to consult the current entry and subsequent actions, not to reduce the notice to a slogan. Its broader lesson is clear: new certification, authorization already granted, marketing, importation, and operation are distinct legal categories. A claim that an old FCC ID makes a purchase permissible can be incomplete; a claim that a sales restriction necessarily orders an existing network to shut down can be incomplete too.

The October 2026 component rule closes a different gap

A finished product can contain security-relevant hardware from another supplier. The FCC's Third Report and Order addresses that problem through an authorization restriction on certain logic-bearing hardware components. The final rule published September 11, 2026 became effective October 13. It prohibits authorization where a device incorporates such a component produced by an entity identified on the Covered List and the device would itself be prohibited if that entity had produced the entire device.

This is not a prohibition on every foreign part. The published rule excludes purely mechanical or passive components such as housings, fasteners, resistors, wiring, and plain battery cells from the definition. It also says the component prohibition applies to producer/provider-based determinations, not location-based entries alone, and does not extend this particular prohibition to software or firmware components at this time. Software can still be a security concern; the point is that the adopted legal provision has a defined scope.

The component restriction applies prospectively to new equipment-authorization applications and does not affect previously authorized equipment through that provision. Applications already pending on the effective date are exempt unless later amended in the specified ways to add, substitute, or change a logic-bearing component. Procurement teams should ask for relevant component provenance and change-control evidence, but should not describe the rule as retroactively invalidating every existing device.

The same final rule clarifies online-marketplace responsibilities and introduces FCC ID display requirements with later compliance dates: March 1, 2027 for the category involving marketplace physical access or title to the device, and June 1, 2027 for the specified third-party-listing category without that access or title. The rule contains qualifications and exceptions. An October effective date for the overall rule is not the same as an October compliance deadline for every provision.

Federal contracting introduces a separate set of obligations

Section 889 of the fiscal year 2019 National Defense Authorization Act is implemented through federal acquisition rules. FAR 4.2102 distinguishes restrictions on agencies procuring systems using defined covered equipment as a substantial or essential component, or as critical technology, from restrictions on contracting with an entity that uses such equipment or services. The latter can apply even when the use is unrelated to performance of the federal contract, subject to the applicable exceptions and waivers.

That is why a business selling ordinary services to the federal government may still need to examine its network and suppliers. The issue is not limited to manufacturers bidding to install cellular equipment. The precise definitions, reasonable-inquiry requirements, representations, and contract terms matter. A business should not certify compliance from memory or from a purchasing policy that has never been checked against what is installed.

The FAR 52.204-25 clause defines covered telecommunications equipment and services and describes exceptions, including certain third-party backhaul, roaming, or interconnection arrangements and equipment with specified functional limitations. These are not blanket exemptions for anything bought through an intermediary. Contracting officers and counsel should interpret the actual solicitation, contract, and current rules. FCC authorization and a Section 889 representation are different checks; passing one does not automatically resolve the other.

Rip-and-replace is a funding and implementation problem

Replacing installed network equipment involves far more than unplugging a box. An operator may need to redesign links, integrate another supplier's systems, train technicians, migrate traffic, and dispose of removed equipment while keeping customers connected. For a small or rural provider, the engineering and financial burden can be substantial even when the security objective is accepted.

The FCC Secure and Trusted Communications Networks Reimbursement Program supports eligible providers' reasonable costs to remove, replace, and dispose of specified Huawei or ZTE equipment and services obtained on or before June 30, 2020. Eligibility includes a customer threshold of ten million or fewer. The original application window ran from October 29, 2021 through January 28, 2022 and is closed. Ongoing administration, reimbursement, reporting, or deadline extensions should not be confused with a new open application window.

Nor should reimbursement eligibility be treated as the definition of every equipment prohibition. A funding programme has its own participants, dates, and covered expenses. An equipment-authorization restriction or federal-contract obligation can apply under a different legal framework. For operators, the practical task is to map both the security requirements and the approved implementation plan without assuming that a grant decision answers every compliance question.

Salt Typhoon shows why supplier restrictions are not enough

The threat is not hypothetical in the broad sense that communications networks have been targeted. A November 13, 2024 FBI and CISA joint statement reported a PRC-linked campaign against commercial telecommunications infrastructure. It described theft of customer call-record data, compromise of private communications of a limited number of targeted individuals, and copying of certain information subject to U.S. law-enforcement requests. Those were investigative findings at the time, not a complete present-day inventory of every affected customer or carrier.

A later joint advisory on PRC state-sponsored network activity describes targeting of backbone, provider-edge, and customer-edge routers and techniques for persistence and network modification. The authoring agencies explain that the activity overlaps with commercial reporting using names including Salt Typhoon while using their own generic terminology. It is operational threat guidance, not a legal finding that a particular model is on the Covered List.

The lesson is that product eligibility and network defense work together. An attacker can exploit a trusted supplier's vulnerable software, acquire administrative credentials, or abuse a poorly protected management path. Removing a prohibited product can address a supply-chain requirement without resolving those risks. Network operators still need secure administration, timely supported updates, visibility into configuration changes, and a rehearsed incident-response process.

What network operators should do in practice

Start with an inventory that joins the physical and operational facts: model, serial number, supplier, authorization where relevant, firmware version, support expiry, management interfaces, and the person responsible for each device. Include equipment installed by a contractor and systems acquired through mergers. A purchasing list is not necessarily an accurate map of the network that is actually carrying traffic.

Separate ordinary traffic from administrative access wherever the design permits. Restrict management interfaces to approved paths and operators, use strong authentication supported by the equipment, and avoid unnecessary exposure to the public internet. Monitor changes to accounts, routing, and configuration. Store useful logs where an attacker controlling one device cannot easily erase the entire record. These are defensive recommendations, not a claim that the FCC mandates this exact checklist for every buyer.

Update supported software and investigate equipment that cannot receive security fixes. Test replacement and recovery arrangements before a disruption. Review remote-access privileges held by vendors and subcontractors, including what can be reached and whether access is removed when a support engagement ends. For consequential infrastructure, obtain specialist engineering and legal advice; there is no single consumer-router setting that substitutes for a network security programme.

Commerce's ICTS authority is another policy layer

The Commerce Department's information and communications technology and services, or ICTS, framework concerns certain transactions connected to foreign adversaries and national-security risks. BIS announced a final rule formalizing ICTS review procedures in December 2024, effective February 4, 2025. The framework allows investigation and determinations that can lead to prohibitions or mitigation for covered transactions. It is not, by itself, a universal prohibition on every imported telecom device.

A review authority, a restriction on a specific transaction, an FCC authorization rule, and a sector-specific Commerce rule are not interchangeable. A company involved in a significant technology transaction should identify which authority actually applies rather than treating a general national-security announcement as the operative contract term. Country connections, control relationships, transaction definitions, and any applicable authorization can all matter.

Open RAN and domestic branding are not automatic answers

Open radio access network approaches aim to make parts of the radio network more interoperable across suppliers. That can create procurement options, but interoperability is not the same as demonstrated security. More interfaces and suppliers also mean integration, testing, monitoring, and accountability must be well managed. An operator still needs to know who patches each layer and who takes responsibility when components do not work together safely.

Likewise, domestic branding is not proof of domestic production, and domestic production is not proof that software is free of vulnerabilities. Supplier diversification, clearer component provenance, and reduced dependence can support resilience, but each claim needs evidence. A useful comparison weighs lifecycle support, update integrity, incident cooperation, engineering capacity, and replacement options alongside legal eligibility and purchase price.

A procurement checklist for U.S. buyers

Before ordering, identify the exact model and intended use. Check the current FCC Covered List entry, the device's authorization, relevant import and marketing restrictions, and any specific conditional approval or exception. Request written supplier information about production and relevant component provenance rather than relying only on the logo on the enclosure. Clarify how substitutions during manufacturing will be disclosed and reviewed.

Next, determine whether a federal contract or other sector-specific obligation adds a separate requirement. Document the inquiry used to support any representation. Ask about supported updates, vulnerability disclosure, remote administration, support end dates, and recovery or replacement arrangements. Keep the evidence dated: a device or approval that was suitable for one purchase may not settle a later transaction after a change in law or product design.

Finally, make the operational comparison. Can the replacement integrate with the existing network? Is there a migration plan that protects service continuity? Can the operator manage and monitor the system without depending on undocumented vendor access? A compliant purchase that cannot be securely maintained is not a satisfactory security outcome.

The bottom line

U.S. telecom security policy is increasingly about the whole chain of trust: the finished device, security-relevant components, production arrangements, federal contracting obligations, and the people and systems that administer a live network. The right question is not simply whether a brand is banned. It is whether this device and this transaction meet the rules that apply, and whether the resulting network can be defended over its working life. Legal eligibility is necessary where the law requires it; operational security remains necessary even where a device is fully eligible.

Sources, date, and editorial disclosure

This U.S.-focused explainer was prepared October 26, 2026 from the official FCC Covered List and notices, the September 11 Federal Register final rule, the FCC reimbursement programme, federal acquisition rules, FBI/CISA statements and advisories, and BIS materials linked above. Adopted provisions are distinguished from their later compliance dates and from continuing proposals in the FCC's July 2026 order and further notice. The article does not claim to resolve every subsequent court action, waiver, model-specific approval, or contract interpretation; buyers should check those before acting.

This article was prepared with AI assistance using public sources. No independent human editorial review, original interviews, penetration testing, or product testing is claimed. The accompanying image is an AI-generated editorial illustration of generic telecom equipment, not a photograph of a named supplier's product or a documented facility. This is general information, not legal advice or a device-specific compliance determination.