Export-Controlled Information

Export-controlled information is data, technology, or software that the U.S. government restricts from being shared with foreign persons or governments without proper authorization. Export controls are administered through the International Traffic in Arms Regulations (ITAR) for defense articles and the Export Administration Regulations (EAR) for dual-use items.

Export-controlled information is often also CUI. If you handle ITAR-controlled technical data, you must protect it from unauthorized foreign access — which means restricting access to U.S. persons, using secure storage and transmission, and potentially segregating foreign national employees from this data.

Why It Matters

Export-controlled information adds compliance requirements beyond CMMC. If you handle ITAR or EAR-controlled data, you need controls that restrict access based on citizenship in addition to standard CUI protections — a dimension assessors and regulators will verify.