/compliance-matrix

description: ITAR vs EAR compliance requirements crosswalk

ITAR vs EAR Compliance Matrix

> **Engineering guidance only. Not legal advice.** The matrix below is a simplified planning aid; DDTC and BIS make the actual determinations. The country lists, retention requirements, and residency postures shown here are starting points to discuss with export-control counsel. Sanctions rules in particular shift fast; verify against the [BIS country guidance](https://www.bis.doc.gov/index.php/policy-guidance/country-guidance) before acting on the country-list rows.

Side-by-side comparison of ITAR and EAR requirements to understand overlaps, differences, and compliance strategies.

Arguments

• `$1` - Focus area (optional: overview, controls, cloud, licensing) - defaults to "overview"

Framework Overview

| Aspect | ITAR | EAR | |--------|------|-----| | **Authority** | State Department (DDTC) | Commerce Department (BIS) | | **Scope** | Defense articles, services, technical data (USML) | Dual-use commercial items (CCL) | | **Item List** | US Munitions List (USML) - 21 categories | Commerce Control List (CCL) - 10 categories | | **Personnel** | US persons per 22 CFR 120.62 (citizens, LPRs, "protected individuals" under 8 USC 1324b(a)(3), US entities) | No personnel restrictions (except deemed exports) | | **Geography** | US-located data by default; 22 CFR 120.54 carves out properly-encrypted technical data | BIS-driven (15 CFR 734.6). Sanctions rules in 15 CFR 746 cover comprehensive embargoes (CU, IR, KP, SY), Russia/Belarus (746.8), Crimea/DNR/LNR (746.6), and shift; check current BIS country guidance | | **Registration** | DDTC registration required ($3,000/year) | No registration (except encryption items) | | **Licensing** | License required for most exports | License required for high-level ECCNs, exceptions available |

Control Comparison

| Control Area | ITAR | EAR | Overlap | |--------------|------|-----|---------| | **Access Control** | US persons only verification | Denied party screening (Entity List, DPL, SDN) | ⚠️ Different mechanisms | | **Data Residency** | US-located regions by default (encryption carve-out per 22 CFR 120.54) | Driven by ECCN-specific licensing and current 15 CFR 746 sanctions | ⚠️ Different posture | | **Encryption** | FIPS 140-2 Level 2+ required | FIPS 140-2 for Category 5 Part 2 | ✅ Same standard | | **Audit Logging** | 5-year retention for records within 22 CFR 122.5 scope (not all logs) | Varies by requirement | ⚠️ ITAR has scoped recordkeeping | | **Network Isolation** | Dedicated VPCs for ITAR | No specific requirement | ⚠️ ITAR only | | **Marking** | ITAR classification on all data | ECCN classification on items | ⚠️ Different schemes | | **Third-Party Access** | Restricted CSP access | Normal CSP access | ⚠️ ITAR more restrictive |

Detailed Control Mapping

1. Personnel and Access

**ITAR-1: US Person Verification**

• **Requirement**: Access limited to "US persons" per [22 CFR 120.62](https://www.ecfr.gov/current/title-22/chapter-I/subchapter-M/part-120/subpart-C/section-120.62). That covers citizens, lawful permanent residents, "protected individuals" under 8 USC 1324b(a)(3), and US-incorporated entities. Don't collapse it to "citizens or LPRs only."
• **Cloud Impact**: Verify US-person status per 120.62 category, tag IAM users with the resulting status
• **Verification**: Personnel files documenting which 120.62 category applies, reviewed with HR and counsel

**EAR-2: End-User Screening**

• **Requirement**: Screen against BIS denied parties lists
• **Cloud Impact**: Automated screening on provisioning
• **Verification**: Entity List, DPL, UVL, SDN checks

**Overlap**: ❌ No overlap - different mechanisms

• ITAR focuses on citizenship
• EAR focuses on entity screening

**Compliance Strategy**: Implement both

• Citizenship verification for ITAR systems
• Denied party screening for all systems (including ITAR)

2. Data Residency

**ITAR-2: Data-Residency Posture**

• **Default**: ITAR technical data stored in US-located systems
• **Carve-out**: 22 CFR 120.54 means properly-encrypted technical data isn't automatically released; deployment patterns vary if counsel blesses them
• **Common safe choice**: us-gov-*, us-east-*, us-west-* in commercial regions (with controls), or GovCloud equivalents

**EAR-4: Geographic Access Controls**

• **Authority**: BIS, not this toolkit (15 CFR 734.6)
• **Comprehensive embargoes**: Cuba (CU), Iran (IR), North Korea (KP), Syria (SY) under 15 CFR 746
• **Other current rules**: Russia and Belarus under 15 CFR 746.8; Crimea / so-called DNR / LNR regions of Ukraine under 746.6; sectoral and item-specific rules elsewhere in 746
• **Don't**: treat the four-country list above as complete. The BIS country guidance is the live source.

**Overlap**: ✅ Partial overlap

• US-located ITAR regions tend to satisfy comprehensive embargo blocking by default
• EAR access controls for items not subject to 15 CFR 746 may permit non-US regions; ECCN-specific licensing applies

**Compliance Strategy**:

• **ITAR workloads**: Default to GovCloud or US-located regions; counsel before relying on the encryption carve-out for non-US storage
• **EAR workloads**: Region choice depends on your ECCN, applicable licensing under 15 CFR 740 (license exceptions), and current 15 CFR 746 sanctions. Geo-block per BIS country guidance, not the four-country shorthand.
• **Mixed**: Segregate systems by framework

3. Encryption

**ITAR-3: Encryption Requirements**

• **Requirement**: FIPS 140-2 validated encryption
• **Standard**: Level 2+ HSMs (AWS KMS, Azure Key Vault, GCP Cloud KMS)
• **Keys**: Customer-managed encryption keys (CMEK) recommended

**EAR-3: Encryption Compliance**

• **Requirement**: FIPS 140-2/140-3 for Category 5 Part 2 items
• **Standard**: Same as ITAR - Level 2+ HSMs
• **Classification**: Encryption products require ECCN 5D002/5A002

**Overlap**: ✅ Complete overlap

• Both require FIPS 140-2 validated en