CMMCpedia
Work with me

Terms / What you protect

Export-controlled information

Information whose export could harm national security. It is a CUI category, but export-controlled and CUI are not the same set of information.

Also called export control, EXPT, export-controlled.

Official Source Material

Unclassified information concerning certain items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect the United States national security and nonproliferation objectives. To include dual use items; items identified in export administration regulations, international traffic in arms regulations (ITAR) and the munitions list; license applications; and sensitive nuclear technology information.

Source: CUI Registry, Export Controlled category (marking EXPT), Page last reviewed May 8, 2025

Practitioner Guidance

What it means in practice

Export-controlled and CUI are two different questions, and you must answer both.

Export Controlled is a category in the CUI Registry, so it is easy to assume that anything export-controlled is automatically Controlled Unclassified Information. It is not. CUI turns on provenance. The definition in 32 CFR 2002.4(h) covers information the Government created or possessed. It also covers information you created or possessed for or on behalf of the Government. It excludes information a non-Government entity holds in its own systems that never came from an agency. Export control turns on the technology itself, no matter who owns it.

Your own design can be export-controlled and not be CUI.

If you developed a product independently, with no Government contract and no Government print behind it, that technical data is your intellectual property. It is not CUI to you, because it never came from or was created for an agency. ITAR still applies to it in full. Companies with no defense contracts at all hold export-controlled technology and are subject to the same rules.

Calling something company proprietary answers the CUI question and answers nothing about export control.

This is the trap worth naming plainly. Proprietary ownership is exactly what takes information outside the CUI definition, so the label can be correct. It gives you no relief from the export regulations, which reach a private company's own technology. A drawing can be correctly described as company proprietary, correctly excluded from your CMMC scope, and still expose you to criminal liability if a foreign person can reach it.

Deliver a copy to the Government and that copy becomes CUI.

Provenance is what changes. The design stays yours, and the copy you provided to or created for an agency meets the definition. From then on you hold two things that look identical and carry different obligations. Decide which of your systems holds the delivered version, because that is the system CMMC follows.

Export-controlled CUI carries more marking than the banner.

On a DoD document the banner still reads CUI and nothing else. EXPT goes on the category line of the designation block, the four-line block at the bottom of the first page. The category also requires a distribution statement B through F and a written export warning. The warning says the Arms Export Control Act or the Export Control Reform Act restricts export of the data. Much controlled technical information is export-controlled too, and that overlap is where most defense manufacturers live.

What falls short

  • A scoping decision that treats export-controlled as a synonym for CUI. The two sets overlap heavily and neither contains the other.
  • An access control review that checked employment status but not nationality. Export rules turn on whether a person is a U.S. person, and that is a different question from whether someone works for you.
  • A managed service or monitoring product with administrators outside the United States, deployed over export-controlled data. The ability to reach the data is the exposure, whether or not anyone did.

Edge cases

  • The information is export-controlled but not CUI. CMMC does not reach it, and the export regulations do. Protect it for the right reason and record why it sits outside your assessment scope.
  • You cannot determine the classification of a data set. Ask whoever gave it to you for the classification and the end use. Do not let IT make the call. An export attorney or a program engineering review can produce a written determination, and that memo is the evidence you keep.
  • Photographs and marketing material show a controlled article in detail. If the image is detailed enough to reproduce the item, treat it as technical data and keep it out of public material.

Over-engineering

  • Building a CMMC Level 2 environment to solve an export control problem. They are different regimes with different regulators, and a Level 2 assessment does not address deemed exports.
  • A license application for information that is publicly available without restriction. Determine the classification first, because much of what small companies worry about is not controlled at all.