Who this is for
Manufacturers, engineering firms, and service providers that handle defense articles, defense services, or dual-use technology, especially those with foreign-national employees, overseas partners, or engineering data in the cloud. Export-controlled information is also a CUI category, so this work usually runs alongside your NIST SP 800-171 program and is the most common reason contractors need GCC High.
What we deliver
Export compliance program
A written program built around the elements BIS describes for an effective export compliance program: management commitment, risk assessment, authorization, recordkeeping, training, audits, and handling violations.
Technology control plans
TCPs for each facility and program: who may access what, how visitors and foreign nationals are handled, and how controlled technical data is marked and stored.
Technical enforcement
U.S.-person and license-based access enforced in Entra ID attributes, Conditional Access, Purview labels and DLP, and SharePoint and Teams segmentation, so the rule in the TCP is the rule in the tenant.
Deemed-export screening
An onboarding and access-change process that catches releases of controlled technology to foreign persons in the U.S. before they happen, with a hand-off to counsel for license decisions.
Training & recordkeeping
Role-based training for engineers, sales, shipping, and IT, and a recordkeeping design that meets the retention requirements of both regimes.
Internal audit
Periodic audits of classification records, access, TCP adherence, and the technical controls, with findings tracked to closure.
Where export control meets your CUI program
| Export requirement | Enforced through | Shared with CMMC |
|---|---|---|
| Restrict controlled technical data to authorized persons | Entra ID attributes, Conditional Access, group-scoped sites | Access control (3.1.x) |
| Mark and track controlled data | Purview sensitivity labels and DLP | CUI marking and media protection (3.8.x) |
| Keep data where it is allowed to be | GCC High data residency and U.S.-person support | Boundary and system protection (3.13.x) |
| Know who accessed what | Unified audit log and retention | Audit and accountability (3.3.x) |
| Report and correct violations | Incident process with counsel hand-off | Incident response (3.6.x) |
Where we stop: jurisdiction and classification determinations, license applications, and voluntary disclosures belong to your export counsel and Empowered Official. We build the program, the controls, and the evidence they rely on, and we make sure the technical environment enforces what they decide.
How an engagement runs
- Baseline (2–3 weeks): interview programs, map where controlled technical data lives, and review existing classifications with your counsel.
- Design (3–4 weeks): export compliance manual, TCPs, screening workflow, and the tenant access design that enforces them.
- Enforce (4–8 weeks): configure access, labels, DLP, and segmentation; migrate controlled data into the enforced areas.
- Operate: training cycles, access reviews, and annual internal audits as part of Managed Compliance.
Questions contractors ask us
What's the difference between ITAR and EAR?
ITAR (22 CFR Parts 120–130) is administered by the State Department's DDTC and controls defense articles and services on the U.S. Munitions List. EAR (15 CFR Parts 730–774) is administered by Commerce's BIS and controls dual-use and less sensitive military items on the Commerce Control List. Many contractors carry both, and the program has to handle each correctly.
Is storing ITAR data in the cloud an export?
Under current rules, sending or storing unclassified technical data that is secured with end-to-end encryption meeting the stated standards, and not stored in certain prohibited countries, is not an export. The conditions are specific, which is why most defense contractors use environments like GCC High with U.S. data residency and U.S.-person support, and document the design.
What is a deemed export?
Releasing controlled technology or source code to a foreign person inside the United States is treated as an export to that person's country. For engineering firms, this is the most common exposure: an access grant, a meeting, or a shared folder. Screening at onboarding and on access changes is the control.
Do you make classification determinations?
No. Classification, licensing, and disclosure decisions belong to your counsel and Empowered Official. We implement the program and the controls around their decisions, and we record them so they can be shown later.
Make your export controls enforceable.
Tell us which regimes apply and where your engineering data lives today, and we'll scope the program and the enforcement design. Or email rj@indirectit.com directly.