Transferring access information (decryption keys, passwords, network access codes) needs the same authorisation as the technology or software it unlocks when done with knowledge that it would release them without a required authorisation (for software, source and object code). Software licence keys are classified and controlled under the same ECCN as the software or hardware they enable; the item's authorisation covers its key, and when a licence requirement later arises (for example the end user is added to the Entity List) further exports of the software, hardware and keys, including renewals, need the new authorisation. Keys unlocking dormant functionality are outside this paragraph but may change the item's classification.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.