Export control, named and not advised on

Names the regimes and stops

Technical data of the kind a defence manufacturer holds may be subject to export control, under regimes administered separately from anything discussed elsewhere on this site. The two best known in the United States are the regulations covering defence articles and services and those covering dual-use items.

This entry exists because export control constrains the same architectural decisions that security compliance constrains, and because suppliers regularly assume that satisfying one addresses the other. It does not.

What this entry will not do is tell you what applies to you. Export control determinations turn on the specific item, its technical characteristics and its classification, and getting one wrong carries consequences of a different order from a compliance finding. That is work for qualified export counsel and nobody else.

Three decisions where the regimes collide

Where data is stored and processed. A choice of cloud region or provider made for security reasons may have export implications.

Who administers your systems. Support and administration performed by people of certain nationalities, wherever they are physically located, can engage export rules through the concept of releasing controlled data to a foreign person.

Who your suppliers are and where they sit. Including your own supply chain and any offshore support arrangement.

Each of those is a decision a security programme makes routinely, and each can be made in a way that satisfies the security requirement and creates an export problem.

Compliance with one is not compliance with the other

The security requirement asks you to protect information. Export control asks who may receive it. A perfectly protected system that gives access to a person export rules say may not receive the data satisfies the first and breaches the second.

They are answered by different people using different documents and neither answer substitutes for the other.

Four practical steps, none of them advice

Establish whether your technical data is subject to control, with counsel. Ensure the person running the security programme knows the answer. Include the question in your change process, so that a decision about a cloud region or a support arrangement triggers it. And keep the determination documented.

The failure mode is not usually a bad decision; it is a decision taken by somebody who did not know the question existed.

Where it shows up in daily work

Controlled technical data is typically marked, and the marking travels with the file. A file governance system that preserves and acts on markings is doing something export counsel will care about, and one that strips them is creating a problem.

This is one of the few places where a security product genuinely touches export compliance, and it is worth raising with any vendor.

Nothing in this entry is advice

It names two regimes and describes where they intersect with decisions discussed elsewhere on this site. It states no rule, offers no classification and should not be relied on for any determination.

If you handle technical data for defence programmes and have never had an export assessment, that is the conversation to have, and it is not with us.

Elsewhere in the wider regime

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.