DDTC ITAR Risk Matrix Supplement 1 - University Specific

1

ITAR COMPLIANCE RISK MATRIX FOR UNIVERSITIES

Version

Date

Description of Changes

1.0

09/08/2023

Final

2

SUPPLEMENT 1

ITAR COMPLIANCE RISK MATRIX FOR UNIVERSITIES

This document supplements the Directorate of Defense Trade Controls (DDTC’s) International Traffic in Arms Regulations (ITAR) Compliance Risk Assessment Matrix by

providing guidance specific to universities, research institutes, and laboratories. Users should reference both DDTC’s ITAR Compliance Risk Assessment Matrix and this

document when assessing their ITAR compliance risk.

Note: The ITAR Compliance Assessment Risk Matrix is meant to be a tool for organizations to use to review and assess their ITAR compliance risks and gain a general

understanding of their overall level of ITAR compliance risk. It is not intended to be comprehensive, nor is it intended to be exhaustive. ITAR compliance risks are specific to

each organization’s operations and functions. This information is not intended to serve as a basis for any action or decision on the part of the public or the DDTC. To the extent

there is any discrepancy between this information and either the Arms Export Control Act, as amended (AECA) or the ITAR, the AECA and ITAR will prevail.

ITAR Exposure

LOW RISK

MEDIUM RISK

HIGH RISK

Type of Research

Performed

•

Only conducts research that does not involve

ITAR-controlled activities or products.

•

Only conducts research considered Fundamental

Research (FR) (see ITAR § 120.34(a)(8))

screpancy between this information and either the Arms Export Control Act, as amended (AECA) or the ITAR, the AECA and ITAR will prevail.

ITAR Exposure

LOW RISK

MEDIUM RISK

HIGH RISK

Type of Research

Performed

•

Only conducts research that does not involve

ITAR-controlled activities or products.

•

Only conducts research considered Fundamental

Research (FR) (see ITAR § 120.34(a)(8)).

•

Occasionally conducts ITAR-controlled research

that falls outside the FR (i.e., basic and applied

research in science and engineering, ordinarily

published and performed at an institution of higher

learning in the United States)

•

Frequently conducts research that ITAR-controlled

research that falls outside the FR (i.e., basic and

applied research in science and engineering,

ordinarily published and performed at an institution

of higher learning in the United States)

Development

Work/Product

Development

•

Only develops work products that are not

subject to the ITAR.

•

Performs defense services for systems/articles that

results in an ITAR-controlled defense article or

technical data

•

Develops prototypes covered by ITAR-controlled

“specially designed” and developmental

subcategories.

•

Performs development work controlled under the

ITAR that is segregated from fundamental

research.

•

Performs defense services and/or development work

controlled under the ITAR.

•

Export control function is not sufficiently integrated

into research and/or student work on campus to

comprehensively identify and authorize ITAR-

controlled development work.

Foreign Persons

(Including Work on

ITAR-Controlled

Research)

•

Processes in place to (1) determine if

students, employees, faculty, or visitors on

campus are a foreign person who may be

involved in supporting U.S

Export control function is not sufficiently integrated

into research and/or student work on campus to

comprehensively identify and authorize ITAR-

controlled development work.

Foreign Persons

(Including Work on

ITAR-Controlled

Research)

•

Processes in place to (1) determine if

students, employees, faculty, or visitors on

campus are a foreign person who may be

involved in supporting U.S. government

defense contracts, (2) assess whether such

•

ITAR-controlled work and/or technical

data/defense articles on campus, and all foreign

persons working on ITAR-controlled research are

appropriately export licensed students or scholars.

•

Compliance program resources insufficient to

appropriately vet and address role, proximity, access,

and services provided for those who support U.S.

government defense contracts.

3

ITAR Exposure

LOW RISK

MEDIUM RISK

HIGH RISK

person requires access to ITAR-controlled

work or technical data, and (3) ensure the

required export authorizations or safeguards

are in place.

•

No ITAR-controlled work and/or technical

data/defense articles on campus.

•

Vetting of foreign persons is commensurate

with risk associated with role (e.g.,

undergraduate students, graduate students,

employees, visiting researchers, public

visitors), proximity, access and services

provided.

•

ITAR Compliance Program includes processes to

identify foreign persons and their activities on

campus who might participate in U.S. government

contracts but, is not consistently integrated with

the export control function to assure access

controls and that appropriate prior

approvals/exemptions are obtained.

•

University has a foreign person visitor policy that

addresses their role, proximity, access, and

services provided, and practices are consistent

with ITAR compliance policy.

•

Policies and procedures not in place to identify and

control technical data or defense articles to prevent

unauthorized exports to foreign persons on campus

at appropriate prior

approvals/exemptions are obtained.

•

University has a foreign person visitor policy that

addresses their role, proximity, access, and

services provided, and practices are consistent

with ITAR compliance policy.

•

Policies and procedures not in place to identify and

control technical data or defense articles to prevent

unauthorized exports to foreign persons on campus.

Staffing

•

No ITAR-controlled work and/or technical

data/defense articles on campus.

•

Processes in place to determine (1) if staff is a

foreign person (2) assess whether such person

requires access to ITAR-controlled work or

technical data and (3) ensure the required

export authorizations or safeguards are in

place.

•

Foreign persons on staff with proximity and access

to ITAR activities appropriately managed.

•

Foreign persons on staff and proximity and access to

ITAR activities is not appropriately managed.

Furnishing Defense

Services (ITAR § 120.32)

•

University does not furnish defense services.

•

ITAR compliance program includes appropriate

training, education, and consistent processes to

evaluate and track activities that may constitute

defense services and exports in furtherance of

defense services, e.g.:

o Release of technical data

o DDTC registration, control, ownership, or

inspection of defense articles.

•

University furnishes defense services that are

frequent, of significant duration, performed in more

than one university lab, or by more than one research

group, or of such complexity that identifying,

compartmentalizing, or implementing necessary

ITAR compliance is difficult.

•

ITAR compliance program resources are not

sufficiently matched with university risk profile such

that insufficient processes are in place.

Access/Release/Operation

of ITAR-Controlled

Defense Articles,

including Technical Data

and software

•

University does not have access to or use of

defense articles, technical data, or ITAR-

controlled software

essary

ITAR compliance is difficult.

•

ITAR compliance program resources are not

sufficiently matched with university risk profile such

that insufficient processes are in place.

Access/Release/Operation

of ITAR-Controlled

Defense Articles,

including Technical Data

and software

•

University does not have access to or use of

defense articles, technical data, or ITAR-

controlled software.

•

University accesses, receives, uses defense

articles, technical data, or ITAR-controlled

software.

•

ITAR compliance program includes a process to

identify, track and put appropriate controls around

•

ITAR compliance program resources are insufficient

and insufficiently integrated with operations to

determine whether university accesses, receives, uses

defense articles, technical data, or ITAR-controlled

software.

4

ITAR Exposure

LOW RISK

MEDIUM RISK

HIGH RISK

applicable defense articles, technical data, or

ITAR-controlled software.

•

ITAR compliance program resources are insufficient

and insufficiently integrated with operations to put

appropriate controls around applicable defense

articles, technical data, or ITAR-controlled software.

International Travel

•

University faculty and students conduct no or

minimal international travel.

•

International travel guidance offered to faculty and

students, but export control function is not

sufficiently integrated to capture all international

travel or appropriately review to assess whether

licenses are needed and obtain such authorizations

(licenses/exemptions).

•

International travel review occurs after travel (e.g.,

when receipts are submitted).

•

Sanitized loaner laptops and mobile devices are

made available and suggested to researchers

traveling to § 126.1 countries.

•

Appropriate pre-travel license review is in place to

obtain required authorizations

(licenses/exemptions)

es are needed and obtain such authorizations

(licenses/exemptions).

•

International travel review occurs after travel (e.g.,

when receipts are submitted).

•

Sanitized loaner laptops and mobile devices are

made available and suggested to researchers

traveling to § 126.1 countries.

•

Appropriate pre-travel license review is in place to

obtain required authorizations

(licenses/exemptions).

•

Policies and procedures not in place to track

international travel, obtain prior authorization to hand

carry defense articles, or permit access to technical

data from abroad.

•

Travelers are not consistently trained on applicable

on U.S. export control laws and regulations or

instructed to not provide defense services, engage

with foreign government entities, or access ITAR-

controlled technical data overseas without prior

export authorization.

•

Sanitized loaner laptops and/or mobile devices are

not available, and staff travel with every-day work

laptops, even when traveling to 126.1 countries.

Shipping

•

University does not possess or ship defense

articles or technical data.

•

University has restricted party screening

processes in place.

•

Shipping department works directly with

export control personnel.

•

University’s international shipping program

permits shipping of defense articles and retention

of documentation by non-administrative

departments, relying on training individuals to

recognize red-flag shipments and refer them to the

export office.

•

University has a high volume of international

shipments and has defense article inventory process

not integrated with university's shipping process.

•

Export office is not integrated in the process and

restricted party searches are not consistently

performed.

Procurement

•

Systems in place to identify requested

purchases of ITAR-controlled products,

includes prior notification requirement if item

is ITAR-controlled in procurement terms and

conditions

fense article inventory process

not integrated with university's shipping process.

•

Export office is not integrated in the process and

restricted party searches are not consistently

performed.

Procurement

•

Systems in place to identify requested

purchases of ITAR-controlled products,

includes prior notification requirement if item

is ITAR-controlled in procurement terms and

conditions.

•

Routinely trains procurement staff in how to

red flag purchases that may be ITAR-

controlled.

•

Systems in place to identify requested purchases

of ITAR-controlled products and accept or reject

prior to purchasing/receiving.

•

Systems not in place to identify requested purchases

of ITAR-controlled products and does not routinely

include prior notification requirement for ITAR in

procurement terms and conditions.

•

Procurement is an independent function with no

centralized training and no integration into the export

control function to red flag ITAR-controlled

purchases.

Incubator

•

University does not have incubator (or

equivalent) programs.

•

University has incubator (or equivalent) programs,

but they are limited to faculty, researchers, and

students primarily in support of undergraduate

•

University has incubator (or equivalent) programs,

and they are available to third parties, faculty,

researchers, and students. Graduate level courses are

5

ITAR Exposure

LOW RISK

MEDIUM RISK

HIGH RISK

courses and/or are limited to general scientific,

mathematical, or engineering principles commonly

taught in schools, colleges, and universities, and

university provides training and guidance to the

programs so they can assess in advance whether

they have received or are creating anything that

requires control.

•

Export control function is available to such

programs to assist with implementing appropriate

controls.

encouraged or required to develop or fabricate

prototypes for capstones or industry fellowships

es, and universities, and

university provides training and guidance to the

programs so they can assess in advance whether

they have received or are creating anything that

requires control.

•

Export control function is available to such

programs to assist with implementing appropriate

controls.

encouraged or required to develop or fabricate

prototypes for capstones or industry fellowships.

•

Incubator (or equivalent) programs exist but they are

not integrated with the export control function and do

not receive export control training or guidance to

perform their own analysis and implement their own

controls.

Communication Among

Departments

•

University is small with centralized and

shared services for functions such as human

resources, shipping, immigration, technology

transfer, procurement, travel, etc.

•

University uses standardized software

programs systemwide with automatic triggers

for additional review.

•

University is small to midsized with some

autonomous or decentralized units or campuses.

•

Major university services such as human

resources, sponsored programs, technology

transfers are centralized and/or include automatic

triggers for additional review.

•

Large university with multiple campuses and

organizational structures with complex reporting

lines.

•

Units operate autonomously using their preferred

method for human resources, sponsored programs,

etc.

•

Reviews are initiated ad hoc and primarily personal

communication.

International

Collaboration

•

University has no international engagement

and no research collaborations with foreign

entities.

•

Strategic mission of university is focused on

domestic activity.

•

Does not perform research in or on behalf of

a foreign country.

•

International engagement and travel are allowed

but not encouraged or considered important.

•

International engagement primarily occurs in areas

without ITAR-controlled activities

ional engagement

and no research collaborations with foreign

entities.

•

Strategic mission of university is focused on

domestic activity.

•

Does not perform research in or on behalf of

a foreign country.

•

International engagement and travel are allowed

but not encouraged or considered important.

•

International engagement primarily occurs in areas

without ITAR-controlled activities.

•

Has research collaborations with entities in ITAR

§ 126.1 countries and/or performs research in or

on behalf of these countries but has centralized

programmatic controls to ensure and document

ITAR compliance.

•

International engagement promoted and of strategic

importance. University, including science,

technology, engineering, and math (STEM)

departments, maintains close collaborations with and

in foreign countries, which may include foreign

campuses in ITAR § 126.1 countries.

•

University does not have processes in place to track

international collaborations vis-à-vis access to

defense articles or technical data.

•

Has research collaborations with entities in ITAR §

126.1 countries and/or performs research in ITAR §

126.1 countries – with decentralized or no procedures

for identifying and addressing controls to ensure and

document compliance.

Inventory and tracking

•

No ITAR-controlled inventory.

•

Screening review to prevent purchase or loan

of ITAR-controlled activity.

•

Routinely performs inventory and has processes in

place to track and appropriately control inventory

•

University has not identified where ITAR-controlled

equipment is used.

•

No regularly scheduled inventory tracking.

nsure and

document compliance.

Inventory and tracking

•

No ITAR-controlled inventory.

•

Screening review to prevent purchase or loan

of ITAR-controlled activity.

•

Routinely performs inventory and has processes in

place to track and appropriately control inventory

•

University has not identified where ITAR-controlled

equipment is used.

•

No regularly scheduled inventory tracking.

6

ITAR Exposure

LOW RISK

MEDIUM RISK

HIGH RISK

•

No loaning of university equipment.

access, such that new purchase requests and/or

prototypes receive advance review/evaluation.

•

Research equipment loaned with advance

screening and review.

•

Export control is not involved with loans of research

equipment.

Activities of

Recharge/Service

Centers

•

University performs no ITAR-controlled

activities and does not provide rate-based

services for a fee to any external entity.

•

University permits service centers to perform

defense services on behalf of internal and external

university customers and activities are generally

assessed to determine if the activity constitutes a

defense service, or otherwise involves a defense

article or technical data.

•

Foreign person participants are licensed or

exempted.

•

Non-university external clients and activities are

assessed, screened and activity and personnel are

appropriately controlled, licensed, or exempted as

applicable.

•

University does not evaluate work performed by

service centers to assess performance of defense

services.

•

High level of foreign person involvement.

Areas of Research

Expertise

•

University is wholly liberal arts.

•

University has graduate level research programs in

science and engineering.

•

University has graduate level research programs in

science and engineering and receives substantial U.S.

Department of Defense funding in these areas.

Campuses/Locations

•

Only one U.S. campus in one location.

•

International exchange programs are limited to

undergraduate exchange

is wholly liberal arts.

•

University has graduate level research programs in

science and engineering.

•

University has graduate level research programs in

science and engineering and receives substantial U.S.

Department of Defense funding in these areas.

Campuses/Locations

•

Only one U.S. campus in one location.

•

International exchange programs are limited to

undergraduate exchange.

•

No university owned/operated campuses/locations

overseas.

•

Multiple campuses in the United States.

•

University owned/operated campuses/locations

overseas.

Information Technology

(IT) Infrastructure

•

Centrally managed IT.

•

Policy on use of cloud and super-computing,

practices align with ITA compliance policy.

•

Data accessible only to U.S Persons.

•

Technical data is not backed up to servers in

foreign locations, unless compliant with the

provisions of ITAR 120.54(a)(5).

•

IT system is intentionally designed to achieve

the level of safeguarded required under the

ITAR.

•

Combination of IT management (some

autonomous or decentralized units or campuses

maintain independent IT system).

•

University permits use of cloud and super-

computing.

•

Research data may be stored outside United States

and unconfirmed compliance with the provisions

of ITAR 120.54(a)(5).

•

University uses virtual private network (VPN),

ITAR-controlled information is transferred

•

IT departments operate autonomously.

•

No policy or controls on use of cloud or

supercomputing or university defaults to cloud for

storage and transmission with no assessment of cloud

for ITAR-compliance.

•

No compliance program insight into whether data is

stored in or outside of the United States.

•

Insufficient ITAR Compliance Program resources

and/or integration with IT to track and manage

transfer of ITAR-controlled information.

•

Password changes encouraged.

percomputing or university defaults to cloud for

storage and transmission with no assessment of cloud

for ITAR-compliance.

•

No compliance program insight into whether data is

stored in or outside of the United States.

•

Insufficient ITAR Compliance Program resources

and/or integration with IT to track and manage

transfer of ITAR-controlled information.

•

Password changes encouraged.

7

ITAR Exposure

LOW RISK

MEDIUM RISK

HIGH RISK

•

Routine password changes required, and

multi-factor authentication used.

through encrypted file transfer protocols/encrypted

email only.

•

Routine password changes required.

Media/Public Relations

(PR)/Filming Requests

•

No ITAR-controlled activities, defense

articles, or technical data on campus.

•

No media/PR/filming requests/visits permitted to

labs with ITAR-controlled activities, defense

articles, or technical data unless appropriately

managed by export control function.

•

Media/PR/Filming requests are not integrated with

ITAR compliance program.

Publication Restrictions

•

University protocol precludes accepting

publication restrictions and practice is in line

with that protocol.

•

Publication restrictions are coordinated with

ITAR compliance program and are strictly

reviewed through lifecycle.

•

University protocol permits accepting publication

restrictions but only with approval and awareness

of compliance program and senior leadership

•

University has no protocol on publication restrictions

•

individual labs/departments make ad hoc decisions to

accept or decline and the compliance program is not

integrated into/notified of the decision for tracking

purposes

Technology

Transfer/Patents

•

University’s technology transfer office is

integrated with the ITAR Compliance

Program such that restrictions are highlighted

on funding associated with work that results

in an invention disclosure and ITAR

Compliance Program input is sought prior to

filing for patent protection and/or making

available for commercial licens

e decision for tracking

purposes

Technology

Transfer/Patents

•

University’s technology transfer office is

integrated with the ITAR Compliance

Program such that restrictions are highlighted

on funding associated with work that results

in an invention disclosure and ITAR

Compliance Program input is sought prior to

filing for patent protection and/or making

available for commercial license.

•

The technology transfer office receives

periodic training to assist in red-flagging

disclosures that may relate to or contain

controlled technical data or defense articles.

•

Restrictions are highlighted on funding associated

with work that results in an invention disclosure

and technology transfer office is encouraged to

seek ITAR compliance program input, but the

processes are not integrated to assure checks and

balances prior to filing for patent protection or

making available for commercial license.

•

The technology transfer office operates

independently of the ITAR compliance program and

is only made aware of relevant funding restrictions if

the researcher provides this information when

making an invention disclosure.

Classified Work

•

University does not accept classified work.

•

University performs classified work but does not

receive or retain classified materials on campus.

•

University performs classified research.

•

No program in place to control classified research or

the compliance program not involved.