Read this guide freely. Request download access with your name and email.
GDF records the selected resource in its lead intake and private Stats.
Open your emailed link for seven days of preparation downloads in this browser.
No marketing subscription is created. Keep completed records in controlled systems.
Prepare business, item, technology, transaction and access facts for an export-control specialist to determine jurisdiction, classification and required authorizations.
Business owners, contract teams, engineering, IT, attorneys and export coordinators
EAR and ITAR preparation with cyber/data-handling questions. Sanctions, customs, nuclear exports, classified information and other regimes may require additional specialists.
EAR and ITAR are different export-control regimes. Neither is a general cybersecurity audit certificate. Start with the items, software, technical information, services and transactions. The specialist determines jurisdiction and classification, including whether another agency or regime applies.
A transaction can involve electronic access, remote support, source-code sharing, engineering collaboration or services as well as physical shipments. Gather who may access what, from where, with which permissions and authorization. Do not infer export eligibility from a US mailing address or citizenship label alone; route person-status questions to counsel through a restricted process.
DDTC registration, where required, does not itself grant export rights. A supplier label, an old ECCN, an ITAR clause or a cloud marketing statement is input for review, not the specialist determination. Keep the supporting classification, license, agreement, provisos and change history together.
EAR 734.18 and ITAR 120.54 contain different conditional provisions for certain encrypted transmission/storage. The current ITAR text reviewed has recent 2026 amendments. Ask the specialist to review the exact current text, encryption boundary, authorized recipients, key control, locations and provider access. Do not use a blanket statement that encryption or a domestic server resolves exports.
Recordkeeping periods have different starting events. EAR 762.6 uses five years from the latest specified event and restricts destruction after an agency request. ITAR 122.5 has its own license/approval/transaction rules and individual variation. Gather the actual dates and hold instructions; have the specialist set the schedule instead of using five years from file creation.
Give each request to the suggested owner. Record what is available and what is unknown in the editable CSV checklist. Use a secure evidence location agreed with the recipient; the checklist is an index, not a place for passwords, real patient data or controlled technical information.
Records to find
Download the editable gathering checklist. CSV files contain plain records, without saved column widths or workbook formatting. Import as UTF-8, keep IDs as text, wrap text and widen columns before use. Blank client fields are intentional.
EX-R01 Entity activities and responsible people
Ask
Business owner
Gather
Legal entities, sites/countries, products, manufacturing, software, research, services, brokering if relevant, customers and export responsibility contacts.
Where to ask
Corporate, engineering and sales records
Why it may be needed
Defines the proposed consultation and possible regimes.
If missing or uncertain
Describe the activity and ask for jurisdiction review; no guessed classification.
ECCNs, USML categories, EAR99 determinations, commodity-jurisdiction/CCATS records if obtained, supplier classifications, rationale, dates and version history.
Where to ask
Export files, suppliers and counsel
Why it may be needed
Shows what was actually determined and which item/version it covers.
If missing or uncertain
Record Not yet determined. A supplier opinion may require confirmation and is not a government determination.
Orders, invoices, shipment/export declarations where applicable, serial/item versions, authorizations referenced, transfer/access records and delivery acknowledgments.
Where to ask
ERP, freight forwarder, engineering and access logs
Why it may be needed
Links activity, authority and recipient over time.
If missing or uncertain
Identify records controlled by another party and arrange an authorized request rather than implying possession.
Schedules, license/transaction dates, record formats, change history, agency requests/holds, storage/access and ability to reproduce complete readable records.
Where to ask
Export archive, providers and legal holds
Why it may be needed
Enables separate EAR/ITAR schedule and reproduction review.
If missing or uncertain
Do not purge based on an assumed common five-year start date.
Download the response template. A useful answer names the actual system, period, supporting record and limits. If you do not know, name the person or provider who can answer.
1. What precisely are you asking the specialist to review: hardware, software, technical data, services or a transaction?
Suggested responder
Client IT or system owner
Useful supporting record
Item/version list and a sanitized activity description.
2. Who made each existing classification and what version and facts did it cover?
Suggested responder
Client IT or system owner
Useful supporting record
Dated rationale and government/supplier correspondence, clearly distinguished.
3. Where can people outside the approved project view, download or administer the information?
Suggested responder
Client IT or system owner
Useful supporting record
Access map including support, backups, ticketing and collaboration.
4. Can any provider, administrator or subprocessor decrypt the information?
Suggested responder
Client IT or system owner
Useful supporting record
Architecture and key-custody statement; no secrets in the response.
5. Which countries, people and entities are involved in the planned activity?
Suggested responder
Client IT or system owner
Useful supporting record
Restricted transaction/person review file approved by counsel.
6. Which license, agreement, exception or exemption is proposed as the authorization?
Suggested responder
Client IT or system owner
Useful supporting record
Document, provisos, expiration, parties and specialist question.
7. What changed since the previous determination?
Suggested responder
Client IT or system owner
Useful supporting record
Change list covering technology, parties, destinations and services.
8. Are there agency requests, existing holds or uncertain prior transfers?
Suggested responder
Client IT or system owner
Useful supporting record
Counsel-controlled chronology and records index.
Missing facts and specialist decisions
These are explicit handoff questions. Marking records Received does not resolve them. Add client-specific questions and a responsible person.
EX-Q01 Which items/data/services are subject to EAR, ITAR, another regime or a documented exclusion?
Ask
Export-control specialist and counsel
Gather
Specifications, jurisdiction/classification history, technical descriptions and activities
Resolution needed
Written determination tied to the actual item/version; package completion cannot make it.
EX-Q02 Is the proposed storage/access/transfer authorized, including provider support and key access?
Ask
Export-control specialist with IT architect
Gather
Actual access paths, parties/locations, encryption facts and authorizations
Resolution needed
Transaction and system-specific instructions, including unresolved conditions before release.
EX-Q03 Which additional sanctions, nuclear, classified or contractual restrictions need separate review?
Ask
Counsel and appropriate specialist
Gather
Parties, countries, products/services and contract
Resolution needed
Explicit referral or documented exclusion; EAR/ITAR coverage is not assumed to cover every regime.
Sanitized entity/activity and item/version descriptions are supplied first.
Classifications and authorizations are distinguished from proposed classifications and questions.
Access, cloud, technical-data and transaction maps identify unknowns and owners.
Specialist confirms authorization before receiving restricted technical information or advising release.
Download the record index. Use the shared walkthrough for custody, restricted records, missing information and receipt steps.
Sources for this package
Official laws/rules establish duties within their scope. Guidance explains programs; NIST supplies methods; vendor documentation describes possible product behavior. Actual contracts, facts, configuration and case orders still matter.
