Technical data and technology may be exported, reexported or transferred by or to a U.S. person, or a foreign person employee of a U.S. person, who is travelling or on temporary assignment abroad, provided that only U.S. persons or authorised foreign persons possess or use it, sufficient security precautions prevent unauthorised release (for example encryption, secure connections such as VPNs, passwords or other access restrictions on the device, and firewalls), foreign persons receive only what a separate authorisation covers, and the data is not used for foreign production or defense services without separate approval (125.4(b)(9); 740.9(a)(3)). Under the ITAR the traveller must be a U.S. Government employee or directly employed by a U.S. person and not by a foreign subsidiary, classified data must follow the NISPOM, and the exemption is unavailable for 126.1 destinations and ineligible persons (125.4(a)).
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.