Category 5. (Not a hurricane)
Part 2 (Information security)
What kinda nonsense is this woman sputtering? Governmentese.
ECCN stands for export control classification number; it’s used in export compliance.
The base ECCN is always 5 characters. The format:
A category in the first character (0, 1, 2, 3, 4, 5, 6, 7, 8, or 9)
A product group in the second character (A, B, C, D, or E)
Numbers in the last 3 spots
The designation EAR99 means “no ECCN assigned” – many widgetlike goods don’t need a classification on the Commerce Control list. I might know someone *cough* who didn’t get this requirement while programming years ago and locked the format validation to be as shown above.
Category 5 Part 2 – export classifications for those goods not determined to be ITAR but are still controlled…AND that fit within category 5 and part 2.
Here’s an example of one. Compliance geeks, follow along, please.
Look at 5A003. Shows reasons for control.
NS (National security)
AT (Anti-terrorism)
Then in classification for when to the control applies, needs to consider the Country Control Chart, separate info, on whether the good requires an export license when shipped to that country.
(Commerce license, not State department, a whole other thing). ITAR!
Government is clearly government in all of the domains and industries.
Here’s what it looks like on the document if you go find the one for Category 5 Part 2.
NS applies to entire entry – NS Column 2
AT applies to entire entry – AT Column 1 List
++And some potential license exceptions, yet a different reporting process, but less arduous than an export license++
Based License Exceptions (See Part 740 for a description of all license exceptions)
LVS: Yes: $500 for “components.” N/A for systems and equipment.
GBS: N/A
List of Items Controlled Related Controls: N/A Related Definitions: N/A Items: a. Communications cable systems designed or modified to use mechanical, electrical or electronic means to detect surreptitious intrusion;
Note: 5A003.a applies only to physical layer security. For the purpose of 5A003.a, the physical layer includes Layer 1 of the Reference Model of Open Systems Interconnection (OSI) (ISO/IEC 7498-1).
b. “Specially designed” or modified to reduce the compromising emanations of information bearing signals beyond what is necessary for health, safety or electromagnetic interference standards.
I am vastly oversimplifying. But now you know.
Are you involved in your organization’s export classifications, infosec folks?
