ITAR registrants must keep records of the manufacture, acquisition and disposition of defense articles and technical data, defense services, brokering, and Part 130 information, including all exemption documentation and licences, for five years from the expiration of the licence or other approval or from the transaction date for exemption exports; electronic records must be reproducible on paper, legible and readable, and stored so that no entry can be altered without recording the change, who made it and when; records must be produced on request with the equipment and knowledgeable people to read them (122.5). The EAR requires records of export control documents, memoranda, notes, correspondence, contracts, financial records and BIS notifications (762.2) to be kept for five years from the latest of export, known reexport or transfer, or other termination of the transaction, and not destroyed once an agency has requested them (762.6).
This control maps to 5 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 5 it maps to, and the evidence behind each claim, over MCP and REST.