itar-technology-control-plan

name	itar-technology-control-plan
title	ITAR Technology Control Plan
description	Drafts an ITAR Technology Control Plan (TCP) for U.S. export control compliance under 22 CFR 120-130. Use when a user needs to create or update a TCP, export control program, or deemed-export compliance plan. Trigger on mentions of ITAR, TCP, DDTC, USML, deemed export, technical data, or defense article in a compliance-planning context.
author	CaseMark
author_url	https://github.com/CaseMark/skills/tree/main/skills/legal/itar-technology-control-plan
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	us
practice	sanctions
language	en
tags	["drafting","memo","research"]

ITAR Technology Control Plan

Produces an organization-specific, auditable TCP covering USML scoping, technical data controls, U.S. person screening, deemed-export safeguards, cybersecurity, training, audits, and incident response.

Prerequisites

Collect before drafting:

1. Org profile — entity names, DDTC registration status, empowered official, compliance contacts.
2. Programs & scope — contracts, USML categories, items/technical data, facility list.
3. People & access — personnel roster, foreign nationals, visitor workflows, subcontractors.
4. Systems & storage — IT architecture, data repos, collaboration tools, physical storage.
5. Authorizations — licenses/agreements (DSP-5, DSP-73, TAA, MLA), CJ determinations, prior disclosures.
6. Existing policies — security, HR screening, IT, visitor control, incident response, records retention.

Quick Start

1. Gather all prerequisites; flag gaps early.
2. Draft each required section (see Section Outline below).
3. Populate the role matrix, inventory, and training tables with org-specific data.
4. Mark every regulatory citation with [VERIFY] for counsel review.
5. Attach appendices (forms, checklists, facility maps, access roster).
6. Route for empowered-official approval and signature.

Required Sections

#	Section	Key Content
1	Purpose & Authority	TCP applicability; cite ITAR 22 CFR 120-130 [VERIFY].
2	Definitions	Defense article, technical data, export, U.S. person, deemed export — with citations [VERIFY].
3	Scope	Programs/contracts, USML categories (22 CFR 121.1) [VERIFY], facilities, remote-work boundaries.
4	Roles & Governance	Empowered official, compliance officer, IT/security, HR, program owners.
5	Classification & Inventory	USML mapping, CJ workflow (22 CFR 120.4) [VERIFY], marking, version control.
6	Access Controls	U.S. person verification, badge logic, visitor escorts, need-to-know.
7	IT & Cybersecurity	Segmentation, MFA, encryption, logging, device/media restrictions.