High-Level Operating Concepts

This app adds types like Export Control Library, Export Control Class, Security Rule, and IP Export Classification Documents to provide the data model needed to define and enforce access.

IP Export Control Management manages data and authorizes access through the use of the following elements:

  • Define Security Classes
  • Classify Items
  • Record Citizenship and Rules
  • Process Exceptions
  • Protected Secured Items
  • Perform Audits

This page discusses:

See Also
Export Control Libraries
About Exceptions

Define Security Classes

A security officer can create one or more security libraries. Typically each security library will have its own group of security officers. As an example, Rights in Data is typically managed by Contracts or Contracts Data Management, while security of intellectual properties is managed by Legal or Contracts or some combination of the two organizations.

Each security library can have one or more security classes. Unless an individual happens to be a security officer of more than one security class, the individual is not necessarily be aware of or have access to other security classes.

Security Rules and the Rules Engine

IP Export Control Management includes a robust rules engine according to expected rule types to allow product security officers to modify or define new rules and apply them to security classes as needed. Security rules can be reused in multiple security classes. Rule types include:

  • Citizenship
  • Country-of-birth
  • Organization
  • Physical Location
  • Skill

Security Class Attributes

Each security class type has a set of security class attributes. The security officers are able to add, modify, and even delete applicable security class attributes as appropriate and desired. The security officers should not delete the security class attribute group that is assigned by default nor remove the attribute, Process Access Classification, from the security class attributes as that will lead to a loss of protection of IP security assets.

Classify Items

IP Export Control Management includes easy to use interfaces for Security Officers, Control Administrators, and general classifiers of data to search for and classify materials within applicable security classes.

Once the item is added to a class, its assigned security classes are visible on the object. The appropriate security class attributes are visible as well.

For many object types available for classification, a category in the navigation pane is added named IP and Export Control. This category displays a listing of classes and exceptions related to the item. Actions are available to connect, classify and reclassify.

Record Citizenship and Rules

This app enhances the use of People and Organization (P&O) and adds recognition of Countries and Locations to satisfy many of the requirements of Multi-National Export Control.

Human Resources have the ability to manage citizenship and place of birth for personnel to be granted access to data and information. This product recognizes and manages personnel of multi-citizenship. This is a critical feature for Export Control.

Process Exceptions

IP Export Control Management utilizes special exception types to grant access to otherwise restricted data and materials.

Exceptions include the ability to identify organizations and individuals who have been granted access to otherwise restricted data. In addition, electronic copies of the physical documents used to request and grant exceptions are associated with the license. This provides for the necessary audit trail for compliance audits and record retention. Furthermore, the system provides for electronic methods for requesting and approving exceptions and access. The items governed by a security class are easily identified on any exception type that grants assess to those items. Finally, all exceptions are time limited, which ensures that exceptions are turned off and access revoked automatically if the exception is not renewed. This app includes the following preconfigured exceptions: Export Control Documents.

Protect Secured Items

IP Export Control Management applies several features to ensure materials classified within a specific security class are protected and prevent unauthorized access.

As users work within their respective areas of responsibility, they may never know that secured and sensitive information is even in the system. Awareness of the existence of such data is dependent upon the type of masking applied to the items within the security class, as well as, the access provided to an individual user or group.

Perform Audits

IP Export Control Management includes several features to enable security officers and administrators to audit the system for compliance to regulations and identify attempted unauthorized access and report all exports.

Each security class within a given security library includes a list of people authorized to view data within the class. This visibility includes identification of the method by which access is allowed. Therefore, if access has been granted by a license then the appropriate exceptions are identified and accessible for review by the appropriate officer/administrator. The individuals themselves are auditable, as well. From the person object, a security officer can see what security classes that individual has access to and what exceptions have been granted to the individual. Likewise the applicable security officer can view what security clearances have been granted to the person and the expiration dates of clearances, background investigations, and other exceptions.

Additional features of this app include the ability for users to record ad hoc and/or accidental exports of secured information. These export events, such as teleconferences, face-to-face meetings, video conferences, email, etc. can be documented and forwarded to the appropriate security officer for resolution and mitigation as needed. Additionally, this app includes the ability to record and track export events for physical items as well. Shipments of hardware, software, and/or other materials can be recorded on forms such as the Shippers Export Declaration (SED) or the Automated Export System (AES) record. Finally the system records and creates logs of all transfers of data between locations. These logs include people, locations, data, dates, and time of the transfer/export.