ENC authorises 5A002, 5B002, 5D002, 5E002 and 5A004 items, never to or for E:1 or E:2 countries or their nationals. Without classification or reporting: internal development or production by private sector end users headquartered in Supplement No. 3 countries, related-party transfers of non-U.S. items, U.S. subsidiaries and their foreign national staff for internal use, and non-U.S. products incorporating previously classified U.S. encryption components. Immediately on self-classification with an annual self-classification report (by 1 February, per Supplement No. 8 to Part 742, or a no-change email): 5A002.a, z.1, 5B002 and related software not in (b)(2) or (b)(3), and mass market items that become 5A992 or 5D992. After a 30-day classification request (with the Supplement No. 6 to Part 742 technical questionnaire): network infrastructure above stated throughput thresholds, non-public source code, customised or government-tailored items, 5A002.c and z.3 items and related software, penetration tools, public safety radio, cryptanalytic items, open cryptographic interfaces and specific technology ((b)(2), with end-user limits outside Supplement No. 3 countries), and non-mass-market components and toolkits, non-standard cryptography, advanced vulnerability analysis and forensics, and cryptographic activation items ((b)(3)). A new request is needed when cryptographic functionality or ENC-relevant characteristics change; information requested by BIS is due within 14 days. Semi-annual sales reports (by 1 August and 1 February) are due for (b)(2) and (b)(3)(iii) items to destinations other than Australia, Canada and the U.K., with exclusions (64-bit keys, free anonymous downloads, banking uses, bundled source code); key-length upgrades need a prior report. Distributors may use ENC only within its terms; (b)(2) items may not be transferred to government end users in-country; cryptanalytic items, penetration tools and automated vulnerability analysis tools are barred where the exporter knows or has reason to know of unauthorised use against information systems.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.