Protect Export-Controlled Equipment, Technology & Information
Overview
Research involving export-controlled equipment, materials, software, technology, or technical information may require additional safeguards to prevent unauthorized access.
Depending on the export classification, applicable regulations, and research activity, researchers may need to implement physical, electronic, administrative, or other security measures before export-controlled research assets are received, stored, or used.
The Office of Research Security (ORS) assists researchers in identifying export control requirements and determining when Technology Control Plans (TCPs) or other safeguards are required or appropriate.
REQUEST AN EXPORT CONTROL REVIEW
SCHEDULE A CONSULTATION
CONTACT ORS
Contact ORS Before You
Contact ORS before you:
-
Receive export-controlled equipment, software, technology, or technical information.
-
Store export-controlled research information on University or third-party systems.
- Allow visitors, collaborators, students, or other project personnel access to export-controlled research assets when you are uncertain whether access restrictions apply.
-
Allow foreign persons access to export-controlled equipment or technical information.
-
Share export-controlled information through cloud storage, file-sharing platforms, or other electronic systems.
-
Establish a laboratory, workspace, or computing environment for export-controlled research.
-
Are uncertain whether export-controlled research assets require additional safeguards.
Key Considerations
Export-controlled research assets may include:
- Equipment
- Materials
- Software
- Source code
- Technology
- Technical information
- Technical data
The safeguards required depend on the export classification of the research asset, the applicable export regulations, the research activity, and who will have access.
Researchers who are uncertain whether a research asset is export controlled should consult ORS before the research begins.
Some export-controlled research assets require safeguards that limit unauthorized physical access.
Depending on the research activity, appropriate safeguards may include:
- Restricted laboratory or workspace access.
- Locked offices, laboratories, cabinets, or storage areas.
- Controlled visitor access.
- Access limited to authorized project personnel.
- Other project-specific physical security measures.
ORS can assist in determining when additional physical safeguards may be required.
Export-controlled technical information, software, source code, and other electronic research information may require additional safeguards depending on the applicable export regulations and project requirements.
Researchers should consider:
- Where export-controlled information will be stored.
- Who will have access.
- Whether cloud storage or file-sharing services are appropriate.
- Whether project-specific cybersecurity safeguards are required.
ORS can assist in determining whether export control requirements affect electronic access or storage.
Releasing controlled technology, source code, or technical information to a foreign person may constitute a deemed export under U.S. export control regulations.
Before providing access, researchers should determine whether:
- Export control restrictions apply.
- A Technology Control Plan is required.
- An export license or other government authorization may be necessary.
ORS can assist in determining applicable export control requirements.
Some export-controlled research projects require a Technology Control Plan (TCP).
A TCP documents the project-specific administrative, physical, and technical measures used to limit access to export-controlled research assets and support compliance with U.S. export control regulations.
When required, ORS develops Technology Control Plans in coordination with the research team.
Some export-controlled research projects require secure computing environments or additional cybersecurity safeguards.
Researchers should consult ORS whenever export-controlled research will involve:
- Electronic storage of controlled technical information.
- Secure computing environments.
- Controlled access systems.
- Project-specific cybersecurity requirements.
ORS can assist in identifying applicable export control requirements and coordinate with the appropriate University offices when secure research computing or additional cybersecurity safeguards are required.
Related Guidance
| Related Guidance | Description |
|---|---|
| Export Control Classification | Learn how equipment, materials, software, technology, and technical information are classified under U.S. export control regulations. |
| Technology Control Plans | Learn when Technology Control Plans (TCPs) may be used to protect export-controlled technology, technical information, and research activities. |
| Purchase of Research Equipment, Materials, Software & Technology | Guidance for purchasing research equipment, materials, software, technology, chemicals, biologics, and other items that may require research security or export control review. |
| Foreign Person Participating in Research | Guidance for employing foreign national faculty, staff, postdoctoral researchers, and students participating in research activities. |
| Deemed Exports | Learn when releasing controlled technology or source code to a foreign person within the United States may constitute a deemed export. |
| International Transfers (Shipments, Hand-Carry & Electronic Transmissions) | Guidance for shipping, mailing, hand-carrying, or electronically transferring research equipment, materials, software, technology, technical information, or research information internationally. |
| Working with Proprietary & Confidential Research Information | Guidance for receiving, accessing, using, storing, sharing, and protecting proprietary or confidential research information received from sponsors, collaborators, companies, universities, and other external organizations. |
| Working with Government Information | Guidance for receiving, accessing, using, storing, sharing, and protecting government information, including CUI, FCI, Government-Furnished Information (GFI), and other government-controlled information. |
| Secure Research Computing | Guidance for research requiring secure research computing environments, specialized storage, controlled access, or sponsor-required cybersecurity safeguards. |
Frequently Asked Questions
Do all export-controlled research projects require a Technology Control Plan?
No. Whether a Technology Control Plan is required depends on the export classification, research activity, individuals requiring access, and other project-specific circumstances.
Can export-controlled information be stored electronically?
Possibly.
The appropriate storage method depends on the type of export-controlled information, applicable regulations, and project-specific requirements.
Researchers should consult ORS whenever they are uncertain whether additional safeguards are required.
Can foreign persons access export-controlled equipment or technical information?
Possibly.
Access depends on the export classification, applicable regulations, and the type of controlled technology or technical information that would be released. Releasing controlled technology or source code to a foreign person may constitute a deemed export and may require an export license or other authorization. ORS can assist in determining whether access is permitted.
Should I contact ORS before establishing a laboratory for export-controlled research?
Yes.
ORS can assist in determining whether physical, electronic, administrative, or other safeguards are required before export-controlled research begins.
Does using cloud storage or file-sharing services create export control concerns?
It may.
Depending on the export-controlled information involved and the applicable regulations, additional safeguards or restrictions may apply.
Researchers should consult ORS whenever they are uncertain whether export-controlled information may be stored or shared electronically.
Need Assistance?
Most University research does not involve export-controlled equipment, software, technology, or technical information. However, when export-controlled research assets are involved, additional safeguards or access restrictions may be required under U.S. export control regulations.
Early consultation with ORS helps researchers identify applicable export control requirements, determine whether a Technology Control Plan is needed, and establish appropriate safeguards before export-controlled research begins.