Export Compliance and Technology Control Plans
A “Technology Control Plan” (TCP), handled by the export compliance team within the Office of Research Security, is a document exclusively for export-controlled items, technology, and data that specifies who’s responsible for ensuring access controls, physical and information security, and adhering to export control regulations (e.g., the Export Administration Regulations (EAR), International Traffic in Arms Regulations (ITAR), and the Department of Energy’s (DOE) Part 810 rules). Common triggers for a TCP include an item having an export control classification number (ECCN), being assigned a category from the United States Munitions List (USML), being controlled by DOE Part 810, and DFARS 252.225-7048. TCPs do not outline how CUI is protected to comply with NIST standards. In the event a researcher has export-controlled CUI, both a TCP and an SSP will be put in place.
For TCP information contact exportcontrols@illinois.edu.
Controlled Unclassified Information and System Security Plans
A “System Security Plan” (SSP), facilitated by the Regulated Research Program team within the Office of the Chief Information Officer, is a document that outlines controls for IT, people, facilities, management and operations to protect controlled unclassified information (CUI) in compliance with National Institute of Standards and Technology (NIST) 800-171 and 800-53 standards.
Common triggers for an SSP include controlled unclassified information (CUI), covered defense information (CDI), controlled access data (NIH), and DFARS clauses 252.204-7012 and 252.204-7021. SSPs do not outline how export-controlled items, technology, and/or data are protected in compliance with federal export compliance regulations. In the event a researcher has export-controlled CUI, both a TCP and an SSP will be put in place.
For SSP information contact cui-support@illinois.edu.
