Technical data, in any media, may be exported, reexported or retransferred by or to a U.S. person, or a foreign person employee of a U.S. person travelling or on temporary assignment abroad, if foreign persons receive only what a separate authorisation covers, only U.S. persons or authorised foreign persons possess or use it, sufficient security precautions such as encryption, VPNs, device access restrictions and firewalls prevent unauthorised release, the individual is a U.S. Government employee or directly employed by a U.S. person and not by a foreign subsidiary, the data is not used for foreign production or defense services without approval, and classified information follows the NISPOM (125.4(b)(9)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.