research
Start or resume an academic research project — idea through literature, methodology, writing, feedback, and publishing
Determine ITAR vs EAR jurisdiction applicability
> /plugin marketplace add GRCEngClub/claude-grc-engineeringHow it fires
How this command gets triggered: by you, by Claude, or both.
/jurisdictionContext preview
What this command does when you run it.
Determine ITAR vs EAR jurisdiction applicability
description: Determine ITAR vs EAR jurisdiction applicability
> **Engineering guidance only. Not legal advice.** Jurisdiction determinations are made by DDTC and BIS (Commodity Jurisdiction and Classification Requests), not by this toolkit. Use the decision framework below as a starting point for internal triage; file a Commodity Jurisdiction (CJ) request or an ECCN classification through counsel before relying on any determination.
Helps determine whether ITAR, EAR, or both apply to your products, technology, and services.
**Is the item on the US Munitions List (USML)?**
The USML contains 21 categories of defense articles:
| Category | Description | Examples | |----------|-------------|----------| | I | Firearms | Rifles, pistols, machine guns | | II | Guns and Armament | Artillery, rockets, grenades | | III | Ammunition | Military ammunition | | IV | Launch Vehicles | Missiles, rockets, launch vehicles | | V | Explosives | Plastic explosives, detonators | | VI | Vessels of War | Naval ships, submarines | | VII | Tanks and Military Vehicles | Armored vehicles, tanks | | VIII | Aircraft | Military aircraft, drones | | IX | Military Training Equipment | Simulators, training devices | | X | Protective Personnel Equipment | Body armor, helmets | | XI | Military Electronics | Radar, jamming equipment | | XII | Fire Control Systems | Targeting systems | | XIII | Materials and Miscellaneous | Specialized materials | | XIV | Toxicological Agents | Chemical agents | | XV | Spacecraft | Satellites, space vehicles | | XVI | Nuclear Weapons | (See separate regulations) | | XVII | Classified Articles | Items requiring security clearance | | XVIII | Directed Energy Weapons | Lasers, particle beams | | XIX | Gas Turbine Engines | Military jet engines | | XX | Submersible Vessels | Submarines | | XXI | Miscellaneous | Other defense articles |
If NOT on USML, check if on CCL:
| Category | Description | Examples | |----------|-------------|----------| | 0 | Nuclear | Nuclear materials, equipment | | 1 | Materials | Special materials, composites | | 2 | Materials Processing | Machine tools, equipment | | 3 | Electronics | Semiconductors, computers | | 4 | Computers | Processors, supercomputers | | 5 | Telecommunications | Encryption, networking | | 6 | Sensors and Lasers | Sensors, optical equipment | | 7 | Navigation and Avionics | GPS, inertial systems | | 8 | Marine | Marine equipment | | 9 | Aerospace and Propulsion | Aircraft parts, engines |
**Product**: Technical data for military aircraft avionics **Analysis**: Military aircraft → USML Category VIII → **ITAR applies** **Posture (validate with counsel)**: DDTC registration, US-person access, US-located data by default (22 CFR 120.54 encryption carve-out available) **Recommendation**: Use AWS GovCloud or Azure Government
**Product**: Commercial encryption software **Analysis**: Encryption software → CCL Category 5 Part 2 → **EAR applies** **ECCN**: Likely 5D002 (encryption software) **License Exception**: ENC may apply **Requirements**: Self-classification, BIS reporting, embargo screening **Recommendation**: Commercial cloud with FIPS 140-2, geo-blocking
**Product**: Advanced microprocessors **Analysis**: Computer chips → CCL Category 3 or 4 → **EAR applies** **ECCN**: Varies by specifications (3A001, 4A003, etc.) **Requirements**: Entity List screening (China restrictions), classification **Recommendation**: Commercial cloud with denied party screening
**Product**: Jet engine components for both military and commercial aircraft **Analysis**: Dual-use → **Both ITAR and EAR may apply**
**Requirements**: Separate systems for military vs commercial, jurisdiction by use **Recommendation**: Segregated environments (GovCloud for ITAR, commercial for EAR)
**Product**: Infrastructure as a Service (IaaS) **Analysis**: Cloud services generally → **EAR applies** (as a tool) **Customers** may have ITAR/EAR obligations **Requirements**: Provide FIPS encryption, data residency controls, access logs **Recommendation**: Offer GovCloud/Government regions for ITAR customers
**Dual-Use Technology**:
**Technical Data**:
**Deemed Exports**:
If uncertain, submit CJ request to State Department:
**Process**:
1. Submit detailed product description to DDTC 2. DDTC reviews against USML 3. Decision: USML (ITAR) or CCL (EAR jurisdiction) 4. Timeline: 60 days (can extend)
**Cost**: No fee **Form**: DS-4076 Commodity Jurisdiction Request
| Product Type | Likely Jurisdiction | Authority | Key Requirements | |--------------|-------------------|-----------|------------------| | Military weapons | ITAR | State DDTC | US persons, US regions, registration | | Defense technical data | ITAR | State DDTC | US persons, classification, marking | | Encryption software | EAR
Open-source GRC Engineering resource for Claude. claude-grc-engineering turns technical evidence from cloud, SaaS, code, and security tools into framework-aligned findings, gap reports, remediation guidance, evidence packages, and OSCAL workflows.
Repo: GRCEngClub/claude-grc-engineering
Start or resume an academic research project — idea through literature, methodology, writing, feedback, and publishing
Query AWS for compliance-relevant configuration across IAM, S3, CloudTrail, EBS, and emit findings conforming to the v1 contract.
Install the frdocx-to-froscal-ssp Python pipeline and verify its dependencies. Idempotent.
Retrieve a single AWS Secrets Manager secret value to stdout or a 0600-permission file. Opt-in retrieval mode — never writes to the findings cache.
Run testssl.sh against one or more HTTPS endpoints and emit v1 Findings mapped to SOC 2, NIST 800-53, PCI DSS 4.0.1, ISO 27001, and SCF controls.