Controlled information ceases to be controlled only when it genuinely enters the public domain or becomes published. The ITAR recognises information published and generally accessible through listed channels (sales at newsstands and bookstores, unrestricted subscriptions, public libraries, patents, unlimited distribution at public conferences or trade shows in the United States, and public release after approval by the cognizant U.S. Government department or agency, including approval under the 125.4(b)(13) exemption, which does not require actual publication) (120.34(a)). The EAR treats unclassified technology or software as published when made available without dissemination restrictions, including internet posting and submissions to journals or open conferences intended for publication, but keeps published 5D002 encryption software (unless it meets 742.15(b)) and certain firearm production files subject to the EAR (734.7).
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.