Export Controls Preparation Package (EAR and ITAR)
Prepare the business, item, technology, transaction and access facts an export control specialist needs to determine jurisdiction, classification and the authorizations required.
Edition 2026-11-03 | November 3, 2026
Who uses it: Business owners, contract teams, engineering, IT, attorneys and export coordinators.
Scope: The Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR), with cybersecurity and data handling questions. Sanctions, customs, nuclear exports and classified information need their own specialists.
Package 04: Export controls
Prepare the business, item, technology, transaction and access facts an export control specialist needs to determine jurisdiction, classification and the authorizations required. Who uses it: Business owners, contract teams, engineering, IT, attorneys and export coordinators. Scope: The Export Administration Regulations (EAR) and the International Traffic in Arms Regulations (ITAR), with cybersecurity and data handling questions. Sanctions, customs, nuclear exports and classified information need their own specialists.
Before you gather
Start with what the business makes and does. EAR and ITAR are different regimes. List the items, software, technical information, services and transactions; the specialist determines jurisdiction and classification, including whether another agency or regime applies.
Map access as well as shipments. Electronic access, remote support, source code sharing and engineering collaboration can be exports or releases. Gather who may reach what, from where, with which permissions and under which authorization. Route questions about a person's citizenship or status to counsel through a restricted process that confirms status from the right records.
Treat earlier labels as inputs. DDTC registration, where required, sits alongside the licenses and agreements that authorize each export. A supplier's classification, an old ECCN, an ITAR clause or a cloud provider's statement is input for the specialist. Keep each classification, license, agreement and proviso with its change history.
Encryption and records follow their own rules. EAR 734.18 and ITAR 120.54 set different conditions for certain encrypted transmission and storage, so gather the encryption boundary, key custody, locations and provider access. Recordkeeping periods start from different events: EAR 762.6 keeps records five years from the latest of the listed events and bars destruction after an agency request, and ITAR 122.5 has its own rules. Collect the actual dates and holds so the specialist can set the schedule.
Using the worksheets
Give each request to its suggested owner and record each response, including any gap, in Gathering-checklist.csv. Point to records held in the approved evidence location, where passwords, real patient data and controlled technical information stay.
Export controls: records to find
Each request below matches a row in Gathering-checklist.csv. Record the response, status and record IDs there.
EX-R01 Entity activities and responsible people
Ask: Business owner.
Gather: Legal entities, sites or countries, products, manufacturing, software, research, services, brokering if relevant, customers and export responsibility contacts.
Where to ask: Corporate, engineering and sales records.
Why it matters: Defines the proposed consultation and possible regimes.
If missing or uncertain: Describe the activity and ask for jurisdiction review; no guessed classification.
Sources: EA01; IT04
EX-R02 Item and technology descriptions
Ask: Engineering or product owner.
Gather: Part, model or version list, function, performance specifications, materials, source or object code distinctions, drawings, manuals and technical data categories.
Where to ask: Engineering, PLM, repositories and product documentation.
Why it matters: Provides the facts needed for a qualified jurisdiction or classification decision.
If missing or uncertain: Start with a sanitized description and arrange controlled specialist access before sharing technical data.
Sources: EA01; IT01
EX-R03 Existing jurisdiction and classifications
Ask: Export coordinator.
Gather: ECCNs, USML categories, EAR99 determinations, commodity jurisdiction or CCATS records if obtained, supplier classifications, rationale, dates and version history.
Where to ask: Export files, suppliers and counsel.
Why it matters: Shows what was actually determined and which item or version it covers.
If missing or uncertain: Record Not yet determined. Label supplier opinions separately from government determinations.
Sources: EA03; EA04; IT04
EX-R04 Transaction map
Ask: Sales and logistics.
Gather: Proposed or prior transactions, destinations, parties, intermediaries, end users, end uses, routing, reexports or retransfers and ultimate consignees.
Where to ask: CRM, ERP, shipping and project records.
Why it matters: Connects item facts to transaction specific review.
If missing or uncertain: Unknown end use or destination is a question for the specialist before release.
Sources: EA05; EA04; IT04
EX-R05 Authorizations and restrictions
Ask: Export coordinator and counsel.
Gather: Licenses, exceptions or exemptions basis, agreements, registrations where applicable, amendments, provisos, expiration dates and authorized parties/sites/data/services.
Where to ask: BIS or DDTC records and signed agreements.
Why it matters: Allows specialist comparison of actual activity with authorized scope.
If missing or uncertain: Identify the license or authorization for each activity, and record any activity still awaiting one.
Sources: IT03; IT05; EA04
EX-R06 Screening and escalation records
Ask: Compliance and sales.
Gather: Screening procedure, dated results, party identifiers, red flags, end use statements, escalation and release approvals, plus screening tool scope.
Where to ask: Screening provider, compliance and sales.
Why it matters: Supports review of the actual decision at the time of transaction.
If missing or uncertain: Screen against the current restricted party lists and let the specialist confirm license needs for EAR99 items.
Sources: EA05; EA04
EX-R07 Technical information locations
Ask: Engineering and IT.
Gather: Where technical information lives: design or source repositories, email, Teams or Slack, cloud drives, PLM, ticket systems, backups, removable devices and outside partners.
Where to ask: Data source atlas, engineering and providers.
Why it matters: Exposes copies and transfers beyond the product shipment.
If missing or uncertain: Treat candidate locations as unconfirmed until an owner responds.
Sources: EA01; IT01; IT02
EX-R08 Access and support facts
Ask: IT, HR and counsel.
Gather: Actual access roles, contractor or provider organizations, work or support locations, foreign person review process, access approvals and permitted remote administration.
Where to ask: Identity, HR, vendor and access records.
Why it matters: Enables legal review of access or release risk without public disclosure of personal status.
If missing or uncertain: Keep passports and immigration records in the restricted counsel file. Counsel defines lawful, limited verification.
Sources: EA01; IT01; IT02
EX-R09 Cloud and cryptographic facts
Ask: IT architect and provider.
Gather: Services or regions, replication, backups, disaster recovery, subcontractors, admin or support access, encryption boundary, module or strength details, key custody and decryption permissions.
Where to ask: Architecture, service contracts and provider security documents.
Why it matters: Gives the specialist facts for the distinct EAR or ITAR encrypted data provisions.
If missing or uncertain: If keys, provider access or regions are unknown, obtain written technical facts from the provider.
Sources: EA01 734.18; IT02
EX-R10 Technology access procedures
Ask: Export coordinator and IT.
Gather: Existing technology control plans, permission reviews, visitor or collaboration rules, travel or device processes and exception records.
Where to ask: Export, facilities, IT and engineering.
Why it matters: Supplies existing measures, with any implementation records, for specialist review.
If missing or uncertain: Label a draft or proposed measure clearly; specialist determines what the activity requires.
Sources: EA03; EA04; IT04
EX-R11 Shipment and electronic release records
Ask: Logistics and system owners.
Gather: Orders, invoices, shipment or export declarations where applicable, serial or item versions, authorizations referenced, transfer or access records and delivery acknowledgments.
Where to ask: ERP, freight forwarder, engineering and access logs.
Why it matters: Links activity, authority and recipient over time.
If missing or uncertain: Identify records controlled by another party and arrange an authorized request rather than implying possession.
Sources: EA02; IT03
EX-R12 Retention and reproducibility
Ask: Records manager and IT.
Gather: Schedules, license or transaction dates, record formats, change history, agency requests or holds, storage or access and ability to reproduce complete readable records.
Where to ask: Export archive, providers and legal holds.
Why it matters: Enables separate EAR or ITAR schedule and reproduction review.
If missing or uncertain: Keep records until the specialist sets each schedule from its own starting event.
Sources: EA02 762.6; IT03 122.5
EX-R13 Training and business change
Ask: HR and export coordinator.
Gather: Role specific training, attendance, policies, changes to product, ownership, country, personnel or providers and prior advice about those changes.
Where to ask: HR, export program and project history.
Why it matters: Helps the specialist assess whether old decisions still fit current facts.
If missing or uncertain: Record the change and date so the specialist can confirm the determination for the new version or end use.
Sources: EA03; IT04
EX-R14 Prior review and incident records
Ask: Counsel and export lead.
Gather: Previous specialist reports, findings, corrective actions, suspected unauthorized access or shipments, regulator correspondence and disclosure records where authorized.
Where to ask: Restricted counsel or export files.
Why it matters: Avoids repeating unresolved issues or making inconsistent representations.
If missing or uncertain: Send potential violations to counsel and the specialist promptly; counsel decides reportability and any disclosure.
Sources: EA04; IT04
EX-R15 Secure specialist access
Ask: Business sponsor and counsel.
Gather: Identity or authorization of proposed recipients, secure repository, access restrictions, legal agreement and approved transfer method.
Where to ask: Engagement and information security records.
Why it matters: Sharing the preparation evidence can itself require export and privacy review.
If missing or uncertain: Supply a nonsensitive index until authority and secure delivery are agreed.
Sources: EA01; IT02; IT03
Export controls: questions for IT and system owners
A useful answer names the actual system, period, supporting record and limits. Where someone else holds the answer, record who can give it. The same questions are in IT-and-owner-questions.csv.
| No. | Question | Suggested responder | Supporting record |
|---|---|---|---|
| 1 | What precisely are you asking the specialist to review: hardware, software, technical data, services or a transaction? | Client IT or system owner | Item or version list and a sanitized activity description. |
| 2 | Who made each existing classification and what version and facts did it cover? | Client IT or system owner | Dated rationale and government or supplier correspondence, clearly distinguished. |
| 3 | Where can people outside the approved project view, download or administer the information? | Client IT or system owner | Access map including support, backups, ticketing and collaboration. |
| 4 | Can any provider, administrator or subprocessor decrypt the information? | Client IT or system owner | Architecture and key custody statement; no secrets in the response. |
| 5 | Which countries, people and entities are involved in the planned activity? | Client IT or system owner | Restricted transaction or person review file approved by counsel. |
| 6 | Which license, agreement, exception or exemption is proposed as the authorization? | Client IT or system owner | Document, provisos, expiration, parties and specialist question. |
| 7 | What changed since the previous determination? | Client IT or system owner | Change list covering technology, parties, destinations and services. |
| 8 | Are there agency requests, existing holds or uncertain prior transfers? | Client IT or system owner | Counsel controlled chronology and records index. |
Export controls: decisions and handoff
These decisions belong to counsel or the receiving specialist. Each stays open until its owner records a decision. Add questions specific to the client and a responsible person in Open-questions.csv.
Preparing the handoff
The handoff is ready when sanitized descriptions of the entity, activities, items and versions come first; settled classifications and authorizations are kept apart from proposed ones; the access, cloud, technical data and transaction maps name their unknowns and owners; and the specialist has confirmed authorization before receiving restricted technical information.
Use Record-index.csv for one row per file or defined record set, and follow the walkthrough in the library for custody, restricted records and receipt.
| ID | Decision | Decision owner | Information needed | Closed by |
|---|---|---|---|---|
| EX-Q01 | Which items, data or services are subject to EAR, ITAR, another regime or a documented exclusion? | Export control specialist and counsel | Specifications, jurisdiction or classification history, technical descriptions and activities | Written determination tied to the actual item and version. |
| EX-Q02 | Is the proposed storage, access or transfer authorized, including provider support and key access? | Export control specialist with IT architect | Actual access paths, parties or locations, encryption facts and authorizations | Transaction and system specific instructions, including unresolved conditions before release. |
| EX-Q03 | Which sanctions, nuclear, classified or contractual restrictions also apply? | Counsel and appropriate specialist | Parties, countries, products or services and contract | Explicit referral or documented exclusion for each other regime. |
Sources for this package
Laws and regulations set duties within their scope; agency guidance explains how they are applied; NIST supplies methods; vendor documentation describes how a product can behave. The full list is in Source-register.csv.
EA01 EAR scope. Federal regulatory compilation. 734.3, 734.13 to 734.19; jurisdiction, releases and conditional encrypted transmission. https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-734
IT04 DDTC understanding ITAR. Agency jurisdiction guidance. ITAR parts 120 to 130, USML, defense services and brokering. https://www.pmddtc.state.gov/ddtc_public/ddtc_landing?id=ddtc_public_portal_itar_landing
IT01 ITAR definitions. Federal regulatory compilation. 120.31 to 120.33 and 120.50 to 120.63. https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120
EA03 BIS export compliance programs. Agency program guidance. Eight elements of an export compliance program. https://www.bis.gov/learn-support/export-compliance-programs
EA04 BIS export compliance toolkit. Agency guidance index. Classification, screening, technology controls and self audit modules. https://www.bis.gov/learn-support/export-compliance-programs/export-compliance-toolkit
EA05 EAR end user and end use controls. Federal regulatory compilation. Transaction specific end user or end use controls. https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-744
IT03 ITAR registration and recordkeeping. Federal regulatory compilation. 122.1 registration and 122.5 recordkeeping. https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-122
IT05 DDTC registration explanation. Agency registration guidance. Registration process; under 22 CFR 122.1(c) registration is generally a precondition to the issuance of a license or other approval. https://www.pmddtc.state.gov/registration/documents/DS2032v4.4.pdf
IT02 ITAR encrypted technical data provision. Federal regulatory compilation. 120.54(a)(5), (b) and (c). https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120/subpart-C/section-120.54
EA02 EAR recordkeeping. Federal regulatory compilation. 762.2, 762.6; records and retention trigger. https://www.ecfr.gov/current/title-15/subtitle-B/chapter-VII/subchapter-C/part-762
Talk to a senior examiner
Get a free consultation. The initial consultation is free, and requests are handled in confidence.
Call (800) 868-8189 at any hour, or write to info@evestigate.com.
Request a consultation online at evestigate.com/contact.
© 2026 Global Digital Forensics, Inc. All rights reserved.