Global Digital Forensics · Information gathering library · October 18, 2026
Read this guide freely. Choose a download, then share your work email and company or skip.
When you share your details, GDF records the requested resource with your introduction.
Your selected download starts immediately after you share your details or choose Skip.
No marketing subscription is created. Keep completed records in controlled systems.
Prepare business, item, technology, transaction and access facts for an export control specialist to determine jurisdiction, classification and required authorizations.
Business owners, contract teams, engineering, IT, attorneys and export coordinators
EAR and ITAR preparation with cyber and data handling questions. Sanctions, customs, nuclear exports, classified information and other regimes may require additional specialists.
EAR and ITAR are different export control regimes, each governing exports and their authorizations, and both sit apart from cybersecurity audit certification. Start with the items, the software, the technical information, the services and the transactions, because the specialist determines jurisdiction and classification from those facts, including whether another agency or regime applies. A transaction can involve electronic access, remote support, source code sharing, engineering collaboration or services as well as physical shipments, so gather who may access what, from where, with which permissions and under which authorization. Route person status questions to counsel through a restricted process.
DDTC registration, where required, sits alongside the export authorization for each activity. A supplier label, an old ECCN, an ITAR clause or a cloud marketing statement is input for the specialist's review, and the strongest classification file traces each inherited classification back to a documented decision. Keep the supporting classification, the license, the agreement, the provisos and the change history together as one record.
EAR 734.18 and ITAR 120.54 contain different conditional provisions for certain encrypted transmission and storage, and the current ITAR text reviewed has recent 2026 amendments. Ask the specialist to review the exact current text, the encryption boundary, the authorized recipients, the key control, the locations and the provider access. Recordkeeping periods have different starting events: EAR 762.6 uses five years from the latest specified event and restricts destruction after an agency request, and ITAR 122.5 has its own license, approval and transaction rules with individual variation. Gather the actual dates and hold instructions, and have the specialist set the schedule from the specified starting events.
Give each request to the suggested owner. Record each answer, including the items awaiting confirmation, in the editable CSV checklist. Keep the records themselves in a secure evidence location agreed with the recipient and use the checklist as the index that points to them; passwords stay with their owners, and real patient data and controlled technical information stay in the secure location.
Records to find
Download the editable gathering checklist. CSV files hold plain records, and your spreadsheet sets the layout. Import as UTF-8, keep IDs as text, wrap text and widen columns before use. Blank client fields are intentional.
EX-R01 Entity activities and responsible people
Ask
Business owner
Gather
Legal entities, sites/countries, products, manufacturing, software, research, services, brokering if relevant, customers and export responsibility contacts.
Where to ask
Corporate, engineering and sales records
Why it may be needed
Defines the proposed consultation and possible regimes.
If missing or uncertain
Describe the activity and ask for jurisdiction review, leaving the classification field for the specialist.
ECCNs, USML categories, EAR99 determinations, commodity jurisdiction/CCATS records if obtained, supplier classifications, rationale, dates and version history.
Where to ask
Export files, suppliers and legal
Why it may be needed
Shows what was actually determined and which item/version it covers.
If missing or uncertain
Record Not yet determined. Treat a supplier opinion as input that the specialist confirms, distinct from a government determination.
Orders, invoices, shipment/export declarations where applicable, serial/item versions, authorizations referenced, transfer/access records and delivery acknowledgments.
Where to ask
ERP, freight forwarder, engineering and access logs
Why it may be needed
Links activity, authority and recipient over time.
If missing or uncertain
Identify records controlled by another party, note who holds them and arrange an authorized request.
Schedules, license/transaction dates, record formats, change history, agency requests/holds, storage/access and ability to reproduce complete readable records.
Where to ask
Export archive, providers and legal holds
Why it may be needed
Enables separate EAR/ITAR schedule and reproduction review.
Download the response template. A useful answer names the actual system, period, supporting record and its coverage. Where the answer sits with someone else, name the person or provider who can give it.
1. What precisely are you asking the specialist to review: hardware, software, technical data, services or a transaction?
Suggested responder
Client IT or system owner
Useful supporting record
Item/version list and a sanitized activity description.
2. Who made each existing classification and what version and facts did it cover?
Suggested responder
Client IT or system owner
Useful supporting record
Dated rationale and government/supplier correspondence, clearly distinguished.
3. Where can people outside the approved project view, download or administer the information?
Suggested responder
Client IT or system owner
Useful supporting record
Access map including support, backups, ticketing and collaboration.
4. Can any provider, administrator or subprocessor decrypt the information?
Suggested responder
Client IT or system owner
Useful supporting record
Architecture and key custody statement; secrets stay with their owners.
5. Which countries, people and entities are involved in the planned activity?
Suggested responder
Client IT or system owner
Useful supporting record
Restricted transaction/person review file approved by counsel.
6. Which license, agreement, exception or exemption is proposed as the authorization?
Suggested responder
Client IT or system owner
Useful supporting record
Document, provisos, expiration, parties and specialist question.
7. What changed since the previous determination?
Suggested responder
Client IT or system owner
Useful supporting record
Change list covering technology, parties, destinations and services.
8. Are there agency requests, existing holds or prior transfers that need review?
Suggested responder
Client IT or system owner
Useful supporting record
Counsel controlled chronology and records index.
Facts to confirm and specialist decisions
These are explicit handoff questions, and each one closes with the specialist's written answer, drawing on the records marked Received. Add client specific questions and a responsible person.
EX-Q01 Which items/data/services are subject to EAR, ITAR, another regime or a documented exclusion?
Ask
Export control specialist and counsel
Gather
Specifications, jurisdiction/classification history, technical descriptions and activities
Resolution needed
Written determination by the specialist, tied to the actual item/version.
EX-Q02 Is the proposed storage/access/transfer authorized, including provider support and key access?
Ask
Export control specialist with IT architect
Gather
Actual access paths, parties/locations, encryption facts and authorizations
Resolution needed
Transaction and system specific instructions, including any conditions to satisfy before release.
EX-Q03 Which additional sanctions, nuclear, classified or contractual restrictions need separate review?
Ask
Legal and appropriate specialist
Gather
Parties, countries, products/services and contract
Resolution needed
Explicit referral or documented exclusion, so each further regime gets its own review alongside EAR/ITAR.
The handoff is ready when sanitized entity, activity, item and version descriptions have been supplied first; when confirmed classifications and authorizations are distinguished from proposed classifications and open questions; when the access, cloud, technical data and transaction maps identify their open items and owners; and when the specialist has confirmed authorization before receiving restricted technical information or advising any release.
Download the record index. Use the shared walkthrough for custody, restricted records, follow up on open items and receipt steps.
Sources for this package
Official laws/rules establish duties within their scope. Guidance explains programs; NIST supplies methods; vendor documentation describes possible product behavior. The package works alongside the actual contracts, facts, configuration and case orders.
