A release of technology or source code abroad by an authorised entity to a foreign person of a third country is not a deemed reexport when: the entity knows the person's most recent citizenship or permanent residency is one to which the export would be authorised; or the person is a bona fide permanent and regular employee, not a proscribed person, exclusively a Country Group A:5 national, with the release inside an A:5 country or the United States; or, for other nationals, the person is such an employee, the release is in the entity's country or the United States, the entity has effective procedures against diversion, and one of six conditions holds (host-nation security clearance; a screening process with a non-disclosure agreement, screening for substantive contacts with D:5 countries, a technology security or clearance plan, screening records kept for the longer of five years or the employment, available to BIS; or U.K., Canadian, Australian or Dutch implementations of the ITAR 126.18 exchanges or Agreements Guidelines exemptions). Substantive contacts and permanent and regular employee (including qualifying long-term contract staff) are defined.
This control maps to 2 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 2 it maps to, and the evidence behind each claim, over MCP and REST.