US ITAR and EAR - Export Control and Data Security
The U.S. export control rules that govern controlled technical data and technology, read across both regimes: the International Traffic in Arms Regulations (22 CFR 120-130, State Department DDTC) for defense articles, technical data and defense services on the U.S. Munitions List, and the Export Administration Regulations (15 CFR 730-774, Commerce Department BIS) for dual-use and other items on the Commerce Control List. Covers jurisdiction and classification, deemed exports and releases to foreign persons, access information and decryption keys, the encrypted storage and cloud carve-out, foreign national employees and visitors, fundamental research and publication, technical data licences and defense service agreements, DDTC registration and empowered officials, party screening and prohibited destinations, shipping documents and export filing, recordkeeping, and violations and voluntary disclosure. Neither regulation imposes a cybersecurity incident reporting duty. Built from the eCFR texts current to 23 September 2026 (ITAR) and 28 August 2026 (EAR).
US ITAR and EAR - Export Control and Data Security is a compliance framework from United States (Department of State, DDTC, and Department of Commerce, BIS); extraterritorial reach to reexports, retransfers and releases abroad with 11 domains and 45 controls that map to 76 other frameworks. The largest domains are Controlled technical data and technology: exports, releases and access – US ITAR and EAR - Export Control and Data Security (7 controls), Authorisations for technical data and defense services – US ITAR and EAR - Export Control and Data Security (5 controls), Foreign persons, employees and visitors – US ITAR and EAR - Export Control and Data Security (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (11)
Authorisations for technical data and defense services – US ITAR and EAR - Export Control and Data Security
| Code | Title |
|---|---|
| us-itar-and-ear-export-control-and-data-security::ITAR 120.15 | Meet the preconditions, limits and certification duty for every exemption used |
| us-itar-and-ear-export-control-and-data-security::ITAR 124.1 and EAR 744.6 | Obtain agreement approval before furnishing defense services and control U.S.-person support activities |
| us-itar-and-ear-export-control-and-data-security::ITAR 124.3-124.8 | Administer approved agreements and their technical data flows |
| us-itar-and-ear-export-control-and-data-security::ITAR 125.3 and 125.7 | Export classified technical data only through the classified licensing and transmittal channels |
| us-itar-and-ear-export-control-and-data-security::ITAR 125.4(b)(4)-(5) and EAR 740.13(a), (g) | Use the copies, revisions and operation-and-maintenance authorisations within their scope |
Controlled technical data and technology: exports, releases and access – US ITAR and EAR - Export Control and Data Security
| Code | Title |
|---|---|
| us-itar-and-ear-export-control-and-data-security::ITAR 120.50 and EAR 734.13 | Treat releases to foreign persons in the United States as deemed exports, applying each regime's nationality rule |
| us-itar-and-ear-export-control-and-data-security::ITAR 120.50(a)(6) and 120.56(a)(4) | Prevent decryption of controlled data outside the United States by unauthorised persons |
| us-itar-and-ear-export-control-and-data-security::ITAR 120.51, 120.52, 123.9(c) and EAR 734.14, 734.16 | Obtain approval before reexporting or retransferring controlled data or items |
| us-itar-and-ear-export-control-and-data-security::ITAR 120.54(a)(2)-(3) and EAR 734.18(a)(2)-(3) | Rely on the U.S.-person-only transfer carve-outs within their limits |
| us-itar-and-ear-export-control-and-data-security::ITAR 120.55 and EAR 734.19 | Treat decryption keys, passwords and other access information as controlled |
| us-itar-and-ear-export-control-and-data-security::ITAR 120.56 and EAR 734.15 | Control releases by visual inspection, oral or written exchange and use of access information |
| us-itar-and-ear-export-control-and-data-security::ITAR 125.2(c) and 125.1(c) | Obtain authorisation before disclosing technical data to foreign persons in any form |
Encryption, storage, cloud and travel – US ITAR and EAR - Export Control and Data Security
| Code | Title |
|---|---|
| us-itar-and-ear-export-control-and-data-security::ITAR 120.54(a)(5) and EAR 734.18(a)(5) | Meet every condition of the encrypted send, take and store carve-out |
| us-itar-and-ear-export-control-and-data-security::ITAR 120.54(c) and EAR 734.18(c) | Allow access to ciphertext by service providers only where the encryption carve-out is met |
| us-itar-and-ear-export-control-and-data-security::ITAR 125.4(b)(9) and EAR 740.9(a)(3) | Secure controlled data carried or accessed by staff travelling or on assignment abroad |
Foreign persons, employees and visitors – US ITAR and EAR - Export Control and Data Security
| Code | Title |
|---|---|
| us-itar-and-ear-export-control-and-data-security::ITAR 120.62-120.63 and EAR 772.1 U.S. person | Establish U.S. person or foreign person status for everyone with access to controlled data |
| us-itar-and-ear-export-control-and-data-security::ITAR 125.4(b)(10) and EAR 740.13(f) | Use the university employee exemptions only with their conditions |
| us-itar-and-ear-export-control-and-data-security::ITAR 125.5 and EAR 734.13(a)(2) | Plan and control foreign visits to facilities holding controlled data |
| us-itar-and-ear-export-control-and-data-security::ITAR 126.18(a)-(c) and EAR 734.20(c) | Screen dual and third-country national employees of foreign recipients before giving them access |
| us-itar-and-ear-export-control-and-data-security::ITAR 126.18(d) and EAR 734.20(b) | Apply the allied-nationality employee exemptions only to eligible nationals and locations |
Jurisdiction, classification and controlled information – US ITAR and EAR - Export Control and Data Security
| Code | Title |
|---|---|
| us-itar-and-ear-export-control-and-data-security::ITAR 120.11 and EAR Supp. 4 to 774 | Determine jurisdiction and classify each item and data set in the prescribed order |
| us-itar-and-ear-export-control-and-data-security::ITAR 120.12 | Request a commodity jurisdiction determination where jurisdiction is unclear |
| us-itar-and-ear-export-control-and-data-security::ITAR 120.33 and EAR 772.1 technology | Identify which information is controlled technical data or technology |
| us-itar-and-ear-export-control-and-data-security::ITAR 120.5(b) and EAR 734.3(b)(1) | Handle mixed ITAR and EAR shipments and data under the correct authority |
Recordkeeping – US ITAR and EAR - Export Control and Data Security
| Code | Title |
|---|---|
| us-itar-and-ear-export-control-and-data-security::ITAR 120.15(e) | Record the prescribed details for every exemption-based export or transfer |
| us-itar-and-ear-export-control-and-data-security::ITAR 122.5 and EAR 762.6 | Keep export records for five years in a legible, unalterable and producible form |
Registration, empowered officials and eligibility – US ITAR and EAR - Export Control and Data Security
| Code | Title |
|---|---|
| us-itar-and-ear-export-control-and-data-security::ITAR 120.67 and 126.13 | Appoint empowered officials and certify eligibility on every application |
| us-itar-and-ear-export-control-and-data-security::ITAR 122.1-122.3 | Register with DDTC before manufacturing, exporting or furnishing defense services, and keep registration current |
| us-itar-and-ear-export-control-and-data-security::ITAR 122.4 | Notify DDTC of registration changes and of foreign ownership transactions |
Research, publication and patents – US ITAR and EAR - Export Control and Data Security
| Code | Title |
|---|---|
| us-itar-and-ear-export-control-and-data-security::ITAR 120.34 and 125.4(b)(13) and EAR 734.7 | Route publication of controlled information through the channels each regime recognises |
| us-itar-and-ear-export-control-and-data-security::ITAR 120.34(a)(8) and EAR 734.8 | Protect the fundamental research status of research results |
| us-itar-and-ear-export-control-and-data-security::ITAR 125.2(b) and EAR 734.10 | Keep patent filings within the patent carve-outs |
Screening, prohibited destinations and end use – US ITAR and EAR - Export Control and Data Security
| Code | Title |
|---|---|
| us-itar-and-ear-export-control-and-data-security::ITAR 120.16 and 127.7 and EAR 744.11 | Screen all parties against debarment, denial and end-user lists before any transaction or release |
| us-itar-and-ear-export-control-and-data-security::ITAR 120.17 and EAR 744.15 | Cooperate with end-use checks and act on unfavourable results |
| us-itar-and-ear-export-control-and-data-security::ITAR 123.9(a) and EAR Supp. 3 to 732 | Determine and document the end user, end use and destination before exporting |
| us-itar-and-ear-export-control-and-data-security::ITAR 126.1 and EAR Part 746 | Block exports, releases and storage involving prohibited destinations |
| us-itar-and-ear-export-control-and-data-security::ITAR 126.1(e) | Report proposed or actual sales and transfers involving 126.1 countries immediately |
Shipping documents, marking and export filing – US ITAR and EAR - Export Control and Data Security
| Code | Title |
|---|---|
| us-itar-and-ear-export-control-and-data-security::ITAR 120.15(f) and 123.24 | Mark packages and certifications for exempt and licensed technical data and mailed exports |
| us-itar-and-ear-export-control-and-data-security::ITAR 123.22 and EAR 758.1 | File export information on time and report technical data exports to DDTC |
| us-itar-and-ear-export-control-and-data-security::ITAR 123.9(b) and EAR 758.6 | Put the destination control statement and classification on commercial invoices |
Violations, disclosure and the compliance programme – US ITAR and EAR - Export Control and Data Security
| Code | Title |
|---|---|
| us-itar-and-ear-export-control-and-data-security::ITAR 127.1 and EAR 764.2 | Prevent the prohibited conduct and hold the organisation responsible for its agents |
| us-itar-and-ear-export-control-and-data-security::ITAR 127.10 and EAR 764.3 | Understand the penalties and administrative consequences that attach to violations |
| us-itar-and-ear-export-control-and-data-security::ITAR 127.12 and EAR 764.5 | Make voluntary disclosures on each regime's timeline and content requirements |
| us-itar-and-ear-export-control-and-data-security::ITAR 127.12(b)(3)(iv) and EAR Supp. 1 to 766 | Run a documented export compliance programme that both regulators credit |
| us-itar-and-ear-export-control-and-data-security::ITAR 127.2 and EAR 764.2(g) | Keep export documents complete and truthful |
Your Compliance Coverage
If you comply with US ITAR and EAR - Export Control and Data Security, you already cover:
EAR - Export Administration Regulations
42%
27 controls mapped
Compare →Virginia CDPA
5%
3 controls mapped
Compare →Uruguay DPL
5%
3 controls mapped
Compare →+ 73 more: ISO/SAE 21434 (5%), Saudi Arabia PDPL (5%)
See all 76 mapped frameworks ↓Maps to 76 other frameworks
Coverage is not the same as your position
This page shows what US ITAR and EAR - Export Control and Data Security overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is US ITAR and EAR - Export Control and Data Security and who does it apply to?
US ITAR and EAR - Export Control and Data Security is a compliance framework from United States (Department of State, DDTC, and Department of Commerce, BIS); extraterritorial reach to reexports, retransfers and releases abroad with 11 domains and 45 controls. The U.S. export control rules that govern controlled technical data and technology, read across both regimes: the International Traffic in Arms Regulations (22 CFR 120-130, State Department DDTC) for defense articles, technical data and defense services on the U.S. Munitions List, and the Export Administration Regulations (15 CFR 730-774, Commerce Department BIS) for dual-use and other items on the Commerce Control List. Covers jurisdiction and classification, deemed exports and releases to foreign persons, access information and decryption keys, the encrypted storage and cloud carve-out, foreign national employees and visitors, fundamental research and publication, technical data licences and defense service agreements, DDTC registration and empowered officials, party screening and prohibited destinations, shipping documents and export filing, recordkeeping, and violations and voluntary disclosure. Neither regulation imposes a cybersecurity incident reporting duty. Built from the eCFR texts current to 23 September 2026 (ITAR) and 28 August 2026 (EAR). It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does US ITAR and EAR - Export Control and Data Security actually require?
US ITAR and EAR - Export Control and Data Security has 45 controls organised across 11 domains. The largest domains are Controlled technical data and technology: exports, releases and access – US ITAR and EAR - Export Control and Data Security (7 controls), Authorisations for technical data and defense services – US ITAR and EAR - Export Control and Data Security (5 controls), Foreign persons, employees and visitors – US ITAR and EAR - Export Control and Data Security (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of US ITAR and EAR - Export Control and Data Security do I already cover?
US ITAR and EAR - Export Control and Data Security maps to 76 other compliance frameworks. The top mapping partners are EAR - Export Administration Regulations (42% coverage), Virginia CDPA (5% coverage), Uruguay DPL (5% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement US ITAR and EAR - Export Control and Data Security?
Start your US ITAR and EAR - Export Control and Data Security compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about US ITAR and EAR - Export Control and Data Security requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 45 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required