# Export Administration Regulations / Arms Export Control Act
Short Answer
Export Administration Regulations / Arms Export Control Act is relevant to GovConCyber because it can affect national-security, export-control, critical-infrastructure, or mission-sensitive information handling. For most government contractors, its relevance is conditional and fact-specific: it matters when a contract, agency program, regulated data set, sector rule, solicitation requirement, or flowdown brings the authority into the contractor’s work.
Why this matters for government contractors
A contractor should care about EAR / ITAR when the work involves export-controlled technical data, ITAR technical data, EAR technology, when the agency incorporates the requirement into the contract, or when the contractor supports a covered program. The law should not be treated as a universal cybersecurity control for every federal contractor. Its practical value is that it helps contracts teams and compliance leads identify a data category, operational role, or legal authority that may sit behind a clause, statement of work, agency instruction, or subcontractor flowdown.
For procurement attorneys, the key question is not simply whether the statute exists. The key question is how the authority becomes binding on the contractor: direct statutory applicability, implementing regulation, acquisition clause, grant condition, agency policy incorporated by contract, data-use agreement, security plan, or customer flowdown.
What the law does
At a high level, EAR / ITAR establishes legal rules, authorities, or restrictions associated with national-security, export-control, critical-infrastructure, or mission-sensitive information handling. In contractor practice, this can affect how information is collected, used, disclosed, protected, reported, transferred, destroyed, or made available to the government or the public. The statute or authority may also define enforcement consequences, agency responsibilities, confidentiality protections, or procurement restrictions.
This page should remain source-anchored and should avoid converting broad statutory policy into contractor obligations unless the authority is directly applicable or incorporated into a binding procurement instrument.
How it reaches contractors
EAR / ITAR may reach contractors in several ways. It may apply directly to certain regulated entities. It may apply because the contractor operates a system for an agency, handles regulated information for or on behalf of the government, supports a covered sector, receives information under limited-use conditions, or sells products/services subject to a procurement restriction. It may also matter through subcontractor flowdowns, data-use agreements, security addenda, agency supplements, or solicitation evaluation criteria.
The implementation team should therefore wire the page to FMR as a trigger-sensitive authority, not a generic universal result. The FMR result should ask what data is handled, which agency or sector is involved, what clauses appear, and whether the contractor is a prime, subcontractor, cloud provider, managed service provider, healthcare/education/financial-service actor, technology supplier, or critical-infrastructure operator.
Procurement and cybersecurity significance
The procurement significance of EAR / ITAR is that it may change what a contractor must represent, protect, report, flow down, or avoid. Depending on the contract, the authority may affect proposal certifications, data inventories, system boundaries, privacy/security plans, incident-response timelines, disclosure review, subcontractor controls, product screening, records retention, export-control handling, or agency reporting.
For cybersecurity teams, the correct takeaway is to map the statute to the data and contract context. Contractors should identify where the relevant data resides, who may access it, what systems store or transmit it, what security standard is incorporated, what reporting or disclosure limits apply, and whether subcontractors or cloud providers touch the same information.
Relationship to other GovConCyber requirements
This page should cross-link to related GovConCyber pages based on the trigger. Common cross-links may include FAR 52.204-21 for FCI, DFARS 252.204-7012 for DoD covered defense information and incident reporting, NIST SP 800-171 for CUI safeguarding, CMMC for DoD verification, FedRAMP for cloud services, the Privacy Act for agency systems of records, HIPAA/HITECH for PHI, FERPA for education records, export controls for technical data, Section 889 and SECURE Technology Act for supply-chain restrictions, and the False Claims Act for enforcement overlays.
What contractors should do
- Identify whether the contract, solicitation, agency instruction, data-use agreement, or flowdown references EAR / ITAR or the protected data category behind it.
- Determine whether the contractor is directly regulated, acting for or on behalf of a regulated entity, or only indirectly affected.
- Map the relevant data to systems, users, subcontractors, cloud services, and external sharing paths.
- Confirm whether an implementing regulation, acquisition clause, grant condition, or agency policy makes the requirement binding.
- Preserve evidence supporting compliance representations and avoid unsupported certifications.
- Escalate uncertain applicability questions to qualified counsel before relying on the page for a contract-specific decision.
Find My Requirements treatment
This page should be a conditional result when the user indicates the relevant data type, sector, contract clause, agency program, or regulated activity. It should display practical actions tied to the applicable contract and data trigger rather than a generic law summary. FMR should display the authority when the user answers indicate the relevant data category, sector, clause, federal program, or supply-chain condition. It should also explain when the authority is only background context and should not drive a standalone compliance task.
Current status
Implementation status for this page: in_force. Source validation should be completed against current U.S. Code, eCFR, Federal Register, and agency materials before publication. If the live implementation relies on this page for FMR results, Claude Code should preserve the mapping but flag any citation mismatch instead of guessing.
Primary citations
- 15 C.F.R. Parts 730–774; 22 C.F.R. Parts 120–130; 22 U.S.C. § 2751 et seq..
- Citation Update Required Before Use for all page-specific implementing regulations, agency guidance, and Federal Register history not separately verified in this package.
---
Source type: hybrid_statute_and_regulation. Implementation status: in_force.