ACE authorises exports, reexports, transfers and deemed exports of cybersecurity items (4A005, 4D004, related 4D001, 4E001.a and .c, 5A001.j and related items), but not to E:1 or E:2 destinations or nationals; not to government end users (broadly defined, including entities 25 percent or more government-owned) of D:1 to D:5 countries, except digital artifacts to police or judicial bodies and items to national CSIRTs in D countries also in A:6 for incident response, vulnerability disclosure or investigations; not to non-government end users in D:1 or D:5 except favourable-treatment end users (U.S. subsidiaries, financial services, insurers, medical institutions) for specified items, vulnerability disclosure, cyber incident response and deemed exports; and never where the exporter knows or has reason to know the item will be used to affect the confidentiality, integrity or availability of information systems without the owner's authorisation.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.