US Export Controls expert covering ITAR and EAR. Provides comprehensive guidance on defense articles (USML), dual-use commercial items (CCL), jurisdiction determination, FIPS encryption, denied party screening, and cloud compliance strategies.
US Export Controls expert covering ITAR and EAR. Provides comprehensive guidance on defense articles (USML), dual-use commercial items (CCL), jurisdiction determination, FIPS encryption, denied party screening, and cloud compliance strategies.
Engineering guidance only. Not legal advice. Export-control determinations come from DDTC (ITAR) and BIS (EAR), not from this toolkit. The claims below are starting points for security engineers working with export-control counsel, not compliance positions to adopt as-is. Citations to read alongside this material: 22 CFR 120.54 (the ITAR encrypted-technical-data carve-out: access to properly-keyed, end-to-end-encrypted technical data is not automatically a release), 22 CFR 122.5 (ITAR recordkeeping, scoped to specific record categories), 15 CFR 734.6 (BIS is the licensing authority on EAR), 15 CFR 746.8 (Russia and Belarus sanctions). The BIS country guidance is the live sanctions list; it moves and this file will lag.
Deep expertise in both ITAR (International Traffic in Arms Regulations) and EAR (Export Administration Regulations) for US export control compliance.
Expertise Areas
Dual Framework Overview
ITAR (International Traffic in Arms Regulations):
Authority: US Department of State, Directorate of Defense Trade Controls (DDTC)
Scope: Defense articles, services, and technical data on the US Munitions List (USML)
Registration: Required ($3,000/year)
Key posture (simplified): access restricted to US persons; technical data stored in US-located systems by default. The 22 CFR 120.54 encrypted-technical-data carve-out means "US-only storage" isn't an absolute rule for properly-encrypted data, so deployment patterns vary. Validate with counsel for your USML category.
EAR (Export Administration Regulations):
Authority: US Department of Commerce, Bureau of Industry and Security (BIS)
Scope: Dual-use commercial items on the Commerce Control List (CCL)
Registration: Not required (except encryption items)
Key posture (simplified): denied-party screening and sanctions-driven access controls. Under 15 CFR 734.6, BIS (not this toolkit) determines what licensing applies to any given item; specific-country rules live in 15 CFR 746 and shift regularly (Russia and Belarus under 746.8, Crimea/DNR/LNR under 746.6, etc.).
ITAR Framework (7 Controls)
ITAR-1: US Person Verification
Requirement: Only "US persons" may access ITAR-controlled technical data. 22 CFR 120.62 defines that term broader than "citizens or green-card holders." It covers:
US citizens (by birth or naturalization)
Lawful permanent residents (green-card holders)
"Protected individuals" under 8 USC 1324b(a)(3) (certain refugees, asylees, and specific visa holders)
US-incorporated entities and US governmental agencies (for entity-level access)
Access policies that say "citizens or LPRs only" over-restrict and can create avoidable HR and employment-law exposure. Use the full 120.62 definition; work with HR and counsel on how you verify each category.
Implementation:
Verify US-person status using documentation appropriate to the 120.62 category (I-9 covers employment eligibility, not ITAR 120.62 scope by itself)
Tag IAM users with US-person status
Implement RBAC limiting access to US persons
Re-verify periodically; document the method for each 120.62 category
Cloud Verification:
# AWS: Tag users with citizenship
aws iam tag-user --user-name john.smith --tags Key=Citizenship,Value=US
# List all users for verification
aws iam list-users --query 'Users[*].UserName'
Common Gaps:
Foreign nationals with admin access
Contractors without citizenship verification
Shared accounts without individual attribution
ITAR-2: Data-Residency Posture (US-Located by Default)
Posture summary: ITAR technical data is stored in US-located systems by default. 22 CFR 120.54 carves out end-to-end-encrypted technical data from the release definition, so there are deployment patterns where non-US storage of encrypted data is defensible. Defaulting to US-located regions is the simplest posture; confirm with counsel before relying on the encryption carve-out or any cloud-provider attestation.
GCP Cloud KMS: FIPS 140-2 Level 3 (Certificate #3666, #4124)
Encryption Coverage:
Data at rest: EBS, S3, RDS, databases
Data in transit: TLS 1.2+ with FIPS cipher suites
Backups and snapshots
ITAR-4: Access Logging and Audit
Requirement summary: 22 CFR 122.5 requires ITAR-registered exporters to retain specific record categories (manufacturing, export transactions, broker records, and similar) for 5 years. This is not a blanket "retain every cloud log for 5 years" mandate. Identify which of your cloud logs carry those record categories and retain those for 5 years; treat general CloudTrail or admin-audit logs that aren't within 122.5 scope as a separate retention decision (operational, security-monitoring, etc.) and set that retention based on your own policy and any other applicable framework.
Logging scope that's usually worth capturing (operational + security, not all strictly under 122.5):
WARNING: This document contains technical data whose export is
restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751,
et seq.) or the Export Administration Act of 1979 (Title 50, U.S.C.,
App 2401 et seq.), as amended. Violations of these export laws are
subject to severe criminal penalties. Disseminate in accordance with
provisions of DoD Directive 5230.25.
ITAR-7: Third-Party Access Control
Requirement: Control access by cloud service providers and third parties
Implementation:
Use GovCloud/Government regions (US persons-only CSP staff)
Enable Customer Lockbox (Azure) for support approval
Service Control Policies to prevent external role assumption
Audit all cross-account access
Commercial Cloud:
AWS: US persons for GovCloud support
Azure: Screened personnel for Government cloud
GCP: Assured Workloads personnel controls
EAR Framework (7 Controls)
EAR-1: Export Control Classification (ECCN)
Requirement: Classify all items with proper ECCN or EAR99
Classification Process:
Is item on USML? → Use ITAR (not EAR)
Is item on CCL? → Assign ECCN
Not on CCL? → Likely EAR99
Common ECCNs:
ECCN
Description
License Required
5D002
Encryption software
Often License Exception ENC
5A002
Encryption hardware
Varies by specification
5E002
Encryption technology
Varies by specification
3A001
Electronic equipment
Varies by destination
4A003
Digital computers
Varies by performance
EAR99
Items not on CCL
No license for most destinations, but licenses can still be required based on destination (15 CFR 746), end-user (Entity List / DPL / SDN), or end-use (15 CFR 744 proliferation and military end-use rules)
Self-Classification:
Review CCL (15 CFR 774 Supplement No. 1)
Determine applicable category (0-9)
Assign ECCN based on specifications
Document classification rationale
EAR-2: End-User and End-Use Screening
Requirement: Screen all customers against BIS denied parties lists
Screening Lists:
List
Authority
Purpose
Entries
Entity List
BIS
National security/foreign policy restrictions
1,400+
Denied Persons List (DPL)
BIS
Export privileges denied
200+
Unverified List (UVL)
BIS
End-use verification failed
100+
Specially Designated Nationals (SDN)
Treasury OFAC
Sanctions program
10,000+
Military End User (MEU)
BIS
China/Russia military restrictions
N/A
Foreign Sanctions Evaders (FSE)
Treasury
Sanctions evasion
70+
Screening Process:
Collect customer information (name, address, country)
Screen against all lists (consolidated screening)
Document screening results and date
Block access if match found
Report matches to BIS/OFAC
Frequency:
Before provisioning new accounts
Quarterly for existing customers
After any BIS list update
Implementation:
# Pseudocode for screeningdefscreen_customer(customer_name, country):
if customer_name in ENTITY_LIST:
return"DENIED - Entity List match"if customer_name in DPL:
return"DENIED - Denied Persons List"if customer_name in SDN:
return"DENIED - OFAC SDN List"if country in EMBARGOED_COUNTRIES:
return"DENIED - Embargoed country"return"APPROVED"
EAR-3: Encryption Compliance (FIPS 140)
Requirement: Encryption items (Category 5 Part 2) must use FIPS 140-2/140-3 validated modules
Release of controlled technology to foreign nationals in the US
Considered an "export" to the person's country
May require license depending on technology and country
Visual inspection or oral exchange may constitute deemed export
Source Code Controls:
Classify source code (often ECCN 5D002 for encryption)
Restrict access by geography and screening
Control access to code repositories (GitHub, GitLab)
Watermark or mark source files
EAR-6: Cloud Service Provider Attestations
Requirement: Verify CSP provides EAR-compliant features
CSP Compliance Features:
Provider
FIPS 140-2
CMEK
Data Residency
Geo-Blocking
AWS
✅ Level 2+
✅ KMS
✅ Regional
✅ WAF, CloudFront
Azure
✅ Level 2
✅ Key Vault
✅ Regional
✅ Front Door, WAF
GCP
✅ Level 3
✅ Cloud KMS
✅ Regional
✅ Cloud Armor
Required Attestations:
FIPS 140-2 validation certificates
Customer-managed encryption keys available
No CSP access to customer data without permission
Data residency controls and documentation
BIS Cloud Computing FAQ:
Cloud services are generally "tools" not "items"
Customer responsible for export compliance
CSP should provide compliant features
EAR-7: License Exception Applicability
Requirement: Determine if License Exception applies (avoiding license requirement)
License Exception ENC (Encryption):
Eligibility:
Encryption items ECCN 5A002, 5D002, 5E002
Self-classification or BIS review
Not available for embargoed countries or denied parties
Requirements:
One-time encryption registration with BIS
Semi-annual self-classification reports
Maintain classification documentation
License Exception TSU (Technology and Software - Unrestricted):
Categories:
Publicly available technology/software
Educational information
Published materials (books, journals, conferences)
Not subject to proprietary/confidential restrictions
Note: Open source software may qualify for TSU
License Exception BAG (Baggage):
Eligibility:
Personal baggage exports
Tools of trade for business travelers
Laptops, phones with encryption
Limits: Reasonable quantities for personal/professional use
License Exception TMP (Temporary):
Eligibility:
Temporary exports/re-exports for:
Testing and evaluation
Demonstrations
Exhibitions and trade shows
Duration: Typically 1 year, renewable
Jurisdiction Determination
Decision Tree:
Step 1: Is the item on the US Munitions List (USML)?
├─ YES → ITAR applies (State Department DDTC jurisdiction)
│ └─ End analysis - use ITAR framework
└─ NO → Continue to Step 2
Step 2: Is the item on the Commerce Control List (CCL)?
├─ YES → EAR applies with specific ECCN
│ ├─ High-level ECCN (e.g., 5D002) → May require license
│ ├─ Check License Exceptions (ENC, TSU, BAG, TMP)
│ └─ Prohibited: embargoed countries, denied parties
└─ NO → Continue to Step 3
Step 3: Item not on USML or CCL
└─ Likely EAR99
├─ No license required for most destinations to most end-users
├─ License still required for exports to comprehensively embargoed destinations (15 CFR 746)
├─ License still required when end-user is on the Entity List, DPL, or SDN
├─ License still required for prohibited end-uses under 15 CFR 744 (proliferation, military end-use, military-intelligence end-use)
└─ The "knowledge" standard applies: if you know or have reason to know the item is destined for a prohibited use or user, a license is required even for EAR99
ITAR-4 requires 5-year retention for the record categories named in 22 CFR 122.5 (not every log)
EAR benefits from logging as operational and audit evidence
Implementation: CloudTrail or equivalent, with retention scoped per 122.5 record categories
Framework-Specific Controls:
ITAR-Only:
ITAR-1: US Person Verification (not required for EAR)
ITAR-2: US-located residency by default, with the 22 CFR 120.54 encryption carve-out available (EAR geography is driven by sanctions and licensing, not a uniform rule)
EAR-2: Denied Party Screening (not ITAR requirement, but recommended)
EAR-7: License Exceptions (not available for ITAR)
Compliance Strategy:
If ITAR applies: Default to strictest controls (US-person access, US-located regions). The 22 CFR 120.54 encryption carve-out gives you some deployment flexibility if counsel blesses it.
If EAR applies: Apply ECCN-specific controls, denied-party screening, and the current 15 CFR 746 sanctions rules.
If both apply: Segregate systems OR apply ITAR defaults plus EAR additions.
Cloud Platform Recommendations
ITAR Workloads:
AWS GovCloud (highly recommended)
FedRAMP High authorized
US persons-only personnel
Physical isolation from commercial
Azure Government (highly recommended)
FedRAMP High authorized
Screened US personnel
GCP Assured Workloads (recommended)
ITAR compliance configuration
Data residency enforcement
EAR Workloads:
AWS Commercial (with controls)
FIPS 140-2 encryption via KMS
WAF for geo-blocking
Denied party screening in provisioning
Azure Commercial (with controls)
FIPS 140-2 Key Vault
Front Door for geo-filtering
GCP Commercial (with controls)
FIPS 140-2 Cloud KMS
Cloud Armor for geo-blocking
Common Implementation Challenges
US Person Verification (ITAR)
Challenge: Citizenship documentation collection
Solution: Integrate with HR onboarding, maintain verification database
Data residency verification: ITAR defaults to US-located storage (with the 22 CFR 120.54 encryption carve-out where counsel approves); EAR residency depends on ECCN, licensing posture, and current 15 CFR 746 sanctions
Cloud platform selection (GovCloud vs commercial) based on framework
Deemed export analysis for foreign national access to technical data
Crosswalk between ITAR and EAR overlapping and unique controls
Compliance cost estimation and resource planning
Export control marking and resource tagging strategies
Audit trail configuration and 5-year retention for records within 22 CFR 122.5 scope
Voluntary self-disclosure guidance for potential violations
