2 cissp ® Official Study Guide Eighth Edition

Import/Export 
The federal government recognizes that the very same computers and encryption technolo-
gies that drive the internet and e-commerce can be extremely powerful tools in the hands of 
a military force. For this reason, during the Cold War, the government developed a complex 
set of regulations governing the export of sensitive hardware and software products to other 
nations. The regulations include the management of transborder data fl ow of new technolo-
gies, intellectual property, and personally identifying information. 
Until recently, it was diffi cult to export high-powered computers outside the United 
States, except to a select handful of allied nations. The controls on exporting encryption 
software were even more severe, rendering it virtually impossible to export any encryption 
technology outside the country. Recent changes in federal policy have relaxed these restric-
tions and provided for more open commerce. 
Two sets of federal regulations governing imports and exports are of particular interest 
to cybersecurity professionals. 
■
The International Traffic in Arms Regulations (ITAR) controls the export of items that 
are specifically designated as military and defense items, including technical informa-
tion related to those items. The items covered under ITAR appear on a list called the 
United States Munitions List (USML), maintained in 22 CFR 121. 
■
The Export Administration Regulations (EAR) cover a broader set of items that are 
designed for commercial use but may have military applications. Items covered by EAR 
appear on the Commerce Control List (CCL) maintained by the U.S. Department of 
Commerce. Notably, EAR includes an entire category covering information security 
products.
Computer Export Controls 
Currently, U.S. fi rms can export high-performance computing systems to virtually any coun-
try without receiving prior approval from the government. There are exceptions to this rule 
for countries designated by the Department of Commerce’s Bureau of Industry and Security 
as countries of concern based on the fact that they pose a threat of nuclear proliferation, 
they are classifi ed as state sponsors of terrorism, or other concerns. These countries include 
Cuba, Iran, North Korea, Sudan, and Syria. 
You can find a list of countries and their corresponding computer export 
tiers on the Department of Commerce’s website at
www.bis.doc.gov
 .

---

Laws