Transmitting technical data or technology to a U.S. person in the United States from another person in the United States is not an export, and transferring it within the same foreign country among U.S. persons only (ITAR) or among persons who are not foreign persons (EAR) is not an export, reexport or transfer, so long as the transfer does not result in a release to a foreign person or a prohibited person (120.54(a)(2)-(3); 734.18(a)(2)-(3)). Internal data flows can be designed around these carve-outs, but they depend on knowing that every recipient, including IT and support staff with access to the channel, is a U.S. person.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.