This year’s defense authorization bill didn’t just fund the Department of Defense, but also set the stage for big changes to foreign investment and export controls.  Signed on August 13, 2018, the John S. McCain National Defense Authorization Act (NDAA) included the Foreign Investment Risk Review Modernization Act of 2018 (FIRRMA) and the Export Control Reform Act (ECRA).

Foreign Investment Risk Review Modernization Act

The Foreign Investment Risk Review Modernization Act (FIRRMA) expands the jurisdiction of the Committee on Foreign Investment in the United States (CFIUS).  CFIUS, an interdepartmental committee chaired by the Treasury Department, was already authorized to review certain business transactions involving foreign investment in the United States that involve national security considerations.

FIRRMA expands the scope of transactions subject to CFIUS review to include transactions involving foreign persons including:

• real estate located in proximity to airports, maritime ports, or sensitive government facilities such as military bases;
• critical infrastructure, critical technologies, or sensitive personal data of US citizens;
• membership on the board of directors or other decision-making rights;
• changes in a foreign investor’s rights resulting in foreign control; and
• other transactions designed to circumvent CFIUS jurisdiction.

FIRRMA also revises filing and review processes and timelines, expanding the ordinary review period from 30 to 45 days, effective when FIRRMA became law.  Notices received before August 13^th will remain subject to the 30 day review period.  FIRRMA also provides for the option for CFIUS to implement filing fees.

The most significant provisions will not be effective until the earlier of eighteen months after the enactment (February 2020) or 30 days after the Secretary of the Treasury publishes a notice that the necessary regulations and resources are in place.  CFIUS may also conduct pilot programs under the new law.

CFIUS has advised businesses to continue to notify transactions as provided in current CFIUS regulations.

The Treasury Department has released a summary of FIRRMA and FIRRMA FAQs.

The International Traffic in Arms Regulations (ITAR) continue to require notification when there are changes to ownership or control (as well as other material changes) under 122.4.  Notification of transfer of ownership or control to a foreign person is required 60 days in advance and is independent of CFIUS processes.  See the State Department’s Directorate of Defense Trade Controls Mergers/Acquisition/Divestitures page for more information.

Export Control Reform Act

The new Export Control Reform Act (ECRA) provides statutory authority for the Export Administration Regulations (EAR) and Antiboycott rules, which have been maintained by emergency executive orders under the International Emergency Economic Powers Act (IEEPA) since the Export Administration Act (EAA) expired in 1994.

Notably, the ECRA also directs the Departments of Commerce, Defense, Energy, and State to “identify emerging and foundational technologies” that may warrant export controls, including CFIUS and export licensing.

Continuing developments from the last year, the ECRA establishes a US government procurement ban on telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation.  It does not reinstate the Department of Commerce’s denial order for ZTE which was lifted in July.  The procurement ban also includes video surveillance and telecommunications equipment produced by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology Company.

The ECRA also increases potential civil penalties to $300,000 (from the most recently inflation-adjusted $295,141).

ECS will continue to monitor developments as new CFIUS regulations and the reviews of “emerging and foundational technologies” are discussed, proposed for comment, and implemented.

On May 8, 2018, the White House announced the termination of U.S. participation in the Joint Comprehensive Plan of Action (JCPOA) with Iran.  Previously suspended sanctions, particularly related to Iran’s energy, petrochemical, and financial sectors will be re-imposed subject to a wind-down periods for existing business.

The Department of the Treasury released a follow-on statement including the following:

As soon as is administratively feasible, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) expects to revoke, or amend, as appropriate, general and specific licenses issued in connection with the JCPOA.  At that time, OFAC will issue new authorizations to allow the wind down of transactions and activities that were authorized pursuant to the revoked or amended general and specific licenses.  At the end of the 90-day and 180-day wind-down periods, the applicable sanctions will come back into full effect.

OFAC also posted FAQs on the re-imposition of sanctions.  Notably, the 90-day wind-down period that ends on August 6, 2018 includes:

ii.  Activities undertaken pursuant to specific licenses issued in connection with the Statement of Licensing Policy for Activities Related to the Export or Re-export to Iran of Commercial Passenger Aircraft and Related Parts and Services (JCPOA SLP); and

iii.  Activities undertaken pursuant to General License I relating to contingent contracts for activities eligible for authorization under the JCPOA SLP.

The 180-day wind-down period that ends on November 4, 2018 includes shipping, shipbuilding, petroleum, and energy sectors.  Other categories of business are distributed between the two wind-down periods.

Due to the wind-down periods, sanctions and license revocations were not yet officially implemented.  The full FAQs may be found here.

For ITAR purposes, Iran was and remains a prohibited destination subject to a policy of denial under Section 126.1.  The Department of Commerce Export Administration Regulations (Section 746.7) include both Commerce Department and OFAC licensing requirements for Iran.

The Department of State, Directorate of Defense Trade Controls (DDTC) has published the following notice on their website:

Industry Notice: Industry Feedback on Electronic Disclosures (DS-7787) (4.12.18) DDTC is developing an electronic version of the current DS-7787: Disclosure of Violations of the Arms Export Control Act form, also known as Disclosures. As an alternative to paper and mail, the online version will allow Industry personnel to submit Disclosures directly through DDTC’s Defense Export Compliance and Control System (DECCS). In an effort to improve this electronic form, DDTC is enabling a test version of the new online process for Industry feedback between April 16, 2018 – April 30, 2018, prior to it being publicly available online. If you are interested in participating, please visit https://pmddtcqa.service-now.com/um/ for more information on how to access and use the test version. Once you have completed testing, you can submit feedback or comments through the Provide feedback button.

As disclosures are an important part of compliance programs, this is a great opportunity to see what DDTC is developing and help make it more useful and user-friendly in the future.

EXPORT COMPLIANCE IN 11 WORDS
A Series on Export Compliance Essentials

(Part 9 of 12)

MONITOR!

Once you have an export compliance program in place, continuous monitoring is critically important to provide reasonable assurance of its effectiveness, enable you to make incremental adjustments to changing situations, and show you ways to improve the program’s efficiency. Annual compliance audits and assessments will be limited in their effectiveness and afford inadequate protection unless they are supported and complemented by the ongoing review processes that should be an integral part of compliance management.

Congratulations! It took a lot of hard work, and more time than you’d expected, but you’ve finally succeeded in getting a comprehensive export compliance program up and running at your company. You’re satisfied that it’s all there—the works, the whole enchilada, all the compliance essentials we’ve been looking at in this series:

• Risk analysis and planning
• A thorough manual with written policies and detailed procedures
• Upper management commitment and involvement
• Initial and repeated multi-level employee training
• Clear delineation of roles, responsibilities, and accountability
• Procedures for jurisdictional determination and product classification
• Obtaining approval for licenses and agreements
• Tracking the use of exemptions and exceptions
• Labeling and marking controlled items and technical data
• Real-time screening of customers, suppliers, service contractors, business partners, new hires, and other parties
• Physical security
• IT security
• Mandatory recordkeeping and records-retention practices
• Mandatory reporting to the government agencies
• Periodic internal and external reviews, with follow-up of findings

All good. Sounds fantastic. We’ve got just a few more questions for you before you take off on that well-earned vacation you’ve been looking forward to. Here’s one:

What provisions have you made for monitoring the operation of your program? In other words, how do you plan to make sure your policies and procedures continue to be adequate and continue to function properly? And how do you plan to make sure you won’t be the last to know if they aren’t working as they should?

In compliance management, as in every other part of life, no matter how carefully you’ve planned and how well you’ve done your homework, there are sure to be some unforeseen challenges. Issues will surface that were not initially identified. A procedure that looked good on paper will be put into practice and turn out to be . . . not so good. Situations and personnel will change without warning, giving rise to a whole new set of problems.

Even the best-designed compliance program is bound to require fine-tuning and frequent adjustments in response to:

• Changes in business needs
• Changes in U.S. export laws and regulations
• Changes in federal agency enforcement policies
• Changes in technology
• Changes in the national economy
• Changes in the global marketplace
• Changes in the global threat environment.

Yes, the annual risk assessments and compliance audits that you wisely included in your compliance plan are one important tool for coping with those challenges, but periodic audits cannot be the whole solution. All too often compliance audits are conducted too long after non-compliance events have already occurred to allow you to correct the issues and problems they uncover before a great deal of damage has been done.

If your company is committing an export violation today, or is about to do so, do you really want to be first apprised of the situation by the annual compliance audit report?  Don’t put off tomorrow what can be done today!

As a compliance officer, you need windows into your compliance program that allow you to view the current state of your company’s internal processes and see which areas need more attention right now. Periodic company-wide audits and assessments are most effective when they are informed and supplemented by day-to-day and week-to-week feedback from operational management, as well as frequent tests, checks, surveys, and “mini-audits” of specific processes and risk points.

Preventing the occurrence of export violations, or at least stopping them before they can multiply, is nearly always less costly and stressful than dealing with their aftermath. Successfully detecting intentional deviations from processes and procedures—such as when an employee purposely ignores or contravenes compliance safeguards for his or her own advantage or convenience—has the added benefit of reinforcing the perception that management prioritizes export compliance, is watching, and will take prompt action when problems occur.

That’s undoubtedly why the DDTC’s Compliance Program Guidelines counsel “internal monitoring” that involves “measurement of effectiveness of day-to-day operations” with “emphasis on validation of full export compliance, including adherence to license and other approval conditions.”

It’s also why the BIS’s Office of Exporter Services included “internal and external compliance monitoring,” along with periodic audits, as one of the Nine Key Elements of an Effective Compliance Program. In the agency’s 145-page handbook for U.S. exporters, Compliance Guidelines: How to Develop an Effective Export Management and Compliance Program and Manual, the BIS recommends “a transaction-level and process-level review of compliance efforts with a special emphasis placed on areas of high risk,” noting that such monitoring can “successfully focus attention at the business-unit level on risk areas at an early stage, affording the opportunity to correct deficiencies before they result in major problems.”

The DDTC and BIS guidance documents agree that internal and external monitoring are both important. Every company or organization, in addition to actively monitoring itself, needs outside assurance from an independent third party that its compliance efforts are on the right track.

The following compliance “best practices” also fall under the general rubric of export compliance monitoring:

• Self-monitoring and reporting by operations staff in all export-related departments and divisions of the company on the effectiveness of specific compliance processes and procedures is requested and implemented.

• Timely crosstalk is encouraged among employees in export-related departments, divisions, and branches within the company to ensure that practical compliance experiences and lessons learned are communicated throughout the entire organization, with a view to improving the effectiveness and efficiency of export controls and promoting consistency of procedures.

• Clear and specific internal procedures have been established and communicated to all employees, including contract employees, for the reporting of potential export compliance problems to management, including the option of reporting export violations anonymously through a mailbox, website, or helpline.

• Employees understand that management considers the reporting of suspected export violations to be the duty of each employee and know that they will be protected from retribution or retaliation of any kind if they raise questions or concerns about compliance in good faith.

• On-site end-use monitoring of personnel performing defense services is performed frequently by qualified export compliance staff to ensure that their activities remain within the scope of the relevant export authorization.

• Previously identified export compliance problems or high-risk areas are revisited to ensure that the prescribed corrective actions were implemented and that they have been effective.

Unlike banks and financial institutions, who may choose to concentrate their compliance monitoring on those transactions with the highest impact on revenue, exporters of defense articles and services, dual-use commodities, technical data, and controlled technology, when monitoring ITAR, EAR, and OFAC compliance, may sometimes need to focus on business areas that have a relatively small revenue impact but carry a large compliance risk. Manufacturing or distribution operations in a developing country, for example, or exports to new trading partners in a formerly embargoed nation whose U.S. trade sanctions were only recently lifted, might be relatively small now, when measured by current sales or profits, but multiple compliance challenges and the potential for serious penalties may call for close and continuous monitoring.

Monitoring day-to-day compliance may seem unexciting, like performing routine maintenance on your car. It undoubtedly requires a significant investment of time, effort, and money, and the benefits may not be immediately evident. But most car owners understand that failure to do so is a sure recipe for disaster.  In other words, don’t let procrastination get in the way of success and continuously monitor your compliance program!

EXPORT COMPLIANCE IN 11 WORDS
A Series on Export Compliance Essentials

(Part 8 of 12)

SCREEN!

Failure to perform Restricted Party Screening was cited as either a root cause or a contributing cause in more than a few recent cases of export violations that resulted in severe penalties for U.S. companies. Protect your company by equipping your people with effective software tools for screening intermediaries and end-users in any potential export transaction.

In export control parlance, the process of checking and cross-referencing the entities involved in an export transaction against a variety of “black lists” prohibiting or curtailing trade with certain individuals, businesses, organizations, and nations is called Restricted Party Screening (RPS) or Denied Party Screening (DPS).

A number of such lists of “entities of concern” are maintained by the U.S. Government; similar lists are maintained by other governments (notably the UK, Canada, and Japan) and international bodies (notably the European Union and the United Nations). The “concerns” about the listed entities may be political or economic in nature (e.g., human rights violations, foreign policy and trade issues), security-related (e.g., terrorism, risk of diversion to WMD programs), or criminal law enforcement matters (e.g., narcotics trafficking, money laundering). All the lists are continually updated; names may be added or deleted at any time.

The U.S. Government takes the laws, regulations, treaties, and agreements that lie behind these sanctions lists very seriously and enforces them vigorously. Multi-million dollar fines and settlements for sanctions violations are not uncommon, and some U.S. firms have had their export privileges revoked or suspended. A breach of trade sanctions can also result in the commission of criminal offenses punishable by imprisonment.

Restricted Party Screening is a compliance control process designed to keep your company from breaking the law and prevent you from incurring penalties by inadvertently doing business with an embargoed country or restricted entity.

Screen. If you’re a frequent or regular exporter (or if you’re actively seeking to market your goods and services more widely overseas), you should be routinely screening not only your customers and potential customers, but any firms or individuals associated with your company’s export business.

Some candidates for RPS include:

• Countries—any places where your buyers, intermediate and ultimate consignees (if different from the buyers), or end-users are based or situated.
• Customers—not just foreign customers, but domestic customers, too, especially if they
• Prospective customers (e.g., RFQs, RFIs).
• Manufacturers, suppliers, and vendors of raw materials, parts, or components.
• Contractors and subcontractors.
• Freight forwarders and customs brokers.
• Shipping companies.
• Foreign banks and other financial institutions.
• Visitors and the companies or governments they represent.
• Brokers, sales representatives, and overseas agents.
• Consultants, including research partners, institutions, and universities.
• Business partners.
• Parties to a potential acquisition or merger.
• Employees and new hires.
• Contract workers.
• Service providers.
• Proposed recipients of software source code and technical data.
• Any “pay to” parties.
• Any “pay from” parties.
• Any “ship to” parties.
• Any other parties associated with an export transaction.

Some managers are under the mistaken impression that the legal requirements for business dealings with restricted or denied parties apply only to international sales or items shipped overseas. That is simply not the case: those prohibitions can also apply to domestic or in-country transactions. If any of the parties to a domestic transaction is listed on one of the U.S. Government’s Blocked, Denied, Entity, Specially Designated Nationals, or Debarred Persons lists, the transaction should be handled with the same caution as would be used in dealing with an overseas transaction — which means you are almost certainly legally prohibited from dealing with that party. So — depending on the nature of your business and products — Restricted Party Screening may be a wise idea for domestic transactions as well as exports.

Re-screen. Because governments and international agencies are continually updating their lists, you need to be continually re-screening your parties. Your Denied Party Screening isn’t really finished until you’re really finished doing business with the party. Repeated screening of previously screened parties may seem like overkill, but it isn’t. Re-screening is imperative to ensure that their names weren’t added to one of the lists since the last time you checked.

How often should re-screening be done? Many compliance professionals would answer, “Every day!” But while daily re-screening is a good practice, an even better answer is, “Real-time!” Today’s RPS screening software, much like your other software, updates continually and automatically, and can be configured to alert you immediately if the status of any previously cleared party has changed.

Even with the necessary screening software in place and properly configured to your company’s needs, continual vigilance remains important. Although the latest trade compliance software uses advanced search methods to return accurate matches, the search results still need to be eyeballed and evaluated by a real live person who is qualified to make an informed decision. Software developers continue to make improvements, but the process of matching the parties to a transaction with an actual restricted party is still far from an exact science, and that isn’t likely to change anytime soon. Part of the problem resides in the lists themselves: the information they provide is often scanty and unreliable. Part of the problem resides in the “entities of concern”: they can be tricky people whose names and addresses are continually morphing. Software can do amazing things, and the programmers I know are all incredibly smart; but it’s hard to write code for gut instincts and horse sense. Final screening decisions are best left to human beings.

Depending on the nature of the list and transaction, a “match” could mean that you are legally forbidden to contract with, sell to, ship to, receive payments from, make payments to, convey technology to, have technical discussions with, or buy from the restricted party. Some U.S. companies simply choose not to engage in any transactions whatsoever with listed entities, even when certain kinds of transactions may not, strictly speaking, be legally prohibited, or when they could pursue and possibly obtain an authorization from the relevant government agency. They may do this as a matter of company policy or corporate values, for the sake of the company’s reputation, from the standpoint of cost-effectiveness, or for other reasons.

Actually, nowhere in the ITAR or EAR is it explicitly stated that a business must perform Restricted Party Screenings or purchase RPS software. So, a failure to screen the parties to a transaction is not in itself an export violation.  But the U.S. Government does require exporters to exercise due diligence to avoid violating U.S. laws and regulations in conducting their export transactions. That requires knowing the who, what, when, where, and how of all their business dealings. And that implies a careful and conscientious review of the denial lists. Realistically speaking, if RPS is not included in your company’s export compliance program, export violations are all but certain. In fact, you may have already committed some.

Keep records. Documenting your screening processes and decision-making, especially your responses to positive matches, is of the utmost importance. If you are asked about the export transaction at a later date, you should be able to explain the rationale behind your determinations clearly and confidently, demonstrating that the necessary level of due diligence was employed. Detailed notes regarding your incident response activities are a must so that facts are clear and your decisions are defensible in the event of a company visit or directed compliance audit.

You may know perfectly well that your company screens every single one of its export transactions thoroughly, but if problems should arise at a later date and it turns out there’s no record anywhere of your RPS activity, it might just as well never have happened. Specifics about who you screened, when you screened, which employee performed the screening, how it was done, and what the screening found must be included in your export recordkeeping.

Have a response plan in place. A compliance control process is worthless unless it includes an incident management plan. What should be done when RPS yields a match, and who should do it? What are your company’s policies and procedures for handling this situation? What’s the next step, and who is responsible to take that step? And what’s the step after that?

A positive screening match may be a cause for concern, but it shouldn’t be a cause for alarm. “False positives” are not uncommon, so you first need to ascertain whether the apparent match is genuine or not. Does the name on the sanctions list that was matched with the name of the party you are screening really refer to the same entity? Individuals and companies frequently have the same or similar names, after all. See if any further identifying details are provided in the search result, such as address, date of birth, the citation of an order in the Federal Register, or a photo. If so, you’re in luck! (Don’t get your hopes up too high, though; the information provided for some “parties of concern” is . . . well, disappointingly minimal.) Check your company’s records; they could also contain information that will help you make this determination, if you’ve had previous dealings with the party.

Sometimes identifying false positives is easy, and sometimes it isn’t. You might need to do a bit of detective work to clear up confusion caused by multiple given names, aliases, middle names, nicknames, abbreviations, alternative spellings, misspellings, different transliterations of foreign alphabets, international subsidiaries, branch offices, and divisions. You can’t skip this detective work, but don’t procrastinate or dilly-dally in getting it done either. Holding up orders and postponing shipments to perfectly legitimate customers is a good way to lose repeat business.

If you determine that a match is valid, however—and only trained and qualified employees should make such ultimate determinations—you must place the transaction on hold immediately and investigate further. That doesn’t mean you should panic. Remember that a match doesn’t equal a violation. If you haven’t exported anything yet, then plainly no export violation has occurred. But, equally plainly, the potential for an export control violation does exist, so additional due diligence is required. Proceed with caution.

The significance of a genuine match depends on the list your party’s name was found on. In some cases, exports of all kinds are strictly prohibited: some countries are subject to comprehensive trade embargoes, and some individuals are denied all trading privileges. In other cases, the restrictions are limited in scope, so you might still be able to export to, or do other business with, the sanctioned party, as long as you first apply to the listing agency and secure an export license or other permission. In still other cases, a name has been placed on a list to indicate that a “red flag” is present in the transaction—some information that couldn’t be verified and requires investigation and clarification.

Use software for screening.  If your company engages in more than a handful of export transactions in the course of a year, you should not try to conduct Restricted Party Screening by scanning each party against each of the sanctions lists, one name and one list at a time. Yes, you can do this; and the U.S. Government has even tried to help you recently by creating a Consolidated Screening List (CSL). But it is very foolish and dangerous to go this route. There are simply too many lists to scan, they are changing too frequently, the information they provide about the restricted parties is too sketchy, evaluating the search results without support is too difficult, and the stakes are much too high to risk a human error resulting in a violation. This initial screening is clearly a task for software, not human eyes and brains.

Many kinds of automated systems are available. Which type of software is best will depend on the nature and size of your export business, your budget, and your business model. Some software systems allow your employees to screen transactions individually through a simple browser-based application. Some permit batch uploading and processing of multiple names and transactions. Some can be fully integrated into your company’s existing ERP software system. Some employ extremely sophisticated search algorithms incorporating “fuzzy logic” and phonetic or “sounds-like” name matching. Some UIs are more user-friendly than others.

If you find all this confusing and aren’t sure what kind of screening system would work for your company — which of the advertised features are truly critical to your compliance and which would be a complete waste of money, given your business model — get some independent, objective, and knowledgeable advice before you make this important decision. Hint: Sales reps from software vendors may be knowledgeable – about their software, at least — but they definitely don’t qualify as “independent” or “objective.” There are experienced export compliance professionals out there. Besides giving you an independent and objective assessment of your compliance risks and vulnerabilities, they can also help you sort out the competing claims of RPS service providers and determine the safest and most economical solution for your business.

Even the simplest and most basic software system, however, will surely save you a lot of time, and will guarantee that you are screening against a database that includes all the relevant lists and is automatically updated every day. Most screening software will also allow you to configure your searches to minimize time-wasting false positives and create detailed reports of your screenings that can serve as defensible compliance audit trails.

We have no horse in this race, and we don’t see this as a compliance process where “one software solution fits all.” There are plenty of reputable vendors out there, offering screening products with a wide range of capabilities and features. There is no dearth of choices. Prices vary from downright-reasonable to guaranteed-to-induce-sticker-shock. (We’ve seen a couple of price quotes that really made us gasp — but those were outliers.)

We have only one recommendation: The worst buying decision you can possibly make is choosing not to invest in an adequate RPS software solution for your business. Take it from us – that’s a choice you can’t afford.

EXPORT COMPLIANCE IN 11 WORDS

A Series on Export Compliance Essentials

(Part 7 of 12)

SECURE!

Wherever your business interfaces with the global marketplace, your workforce should be trained to recognize export-controlled technologies and technical data, and equipped with the know-how and tools to comply with ITAR, EAR, and DoD requirements, as well as industry best practices, for safeguarding sensitive information and combating cyber threats.

Responsible information-handling practices have always been critical to export compliance. In the past few years, however, troubling reports of frequent and successful cyberattacks on U.S. Government agencies and alarming headlines about technical trade secrets stolen from private firms by hackers have moved information security to the top of the priority list for every organization—small, medium-sized, or large.

Under the terms of the ITAR and EAR, manufacturers and exporters are legally responsible to protect certain technical data related to defense articles on the USML (ITAR §120.10), as well as key technologies required for the production, development, or use of items on the CCL (EAR §772.1), against access by unauthorized persons. The disclosure or release of such information without a license, inside and outside company facilities, on the ground and in the cloud, within the U.S. and overseas, constitutes an illegal “export.”

That’s why, if any of your products is export-controlled, you had better make certain that your employees are clearly aware of the fact, that they clearly understand everything it implies, and that this matters to them.

They need to know that they’re responsible for safeguarding technical data of any kind related to the product—engineering drawings and specifications, schematics, blueprints, design analyses, photographs, formulas, performance test results, pilot production schemes, manufacturing procedures, assembly flowcharts, testing and inspection methods, or any other technical information subject to export controls.

They need to know that if they share controlled technical data without appropriate authorization, or if they carelessly allow unauthorized access to it, they’ll be violating U.S. export laws, with potentially serious consequences for the company and for themselves.

You Need to Educate—and Motivate—Your People About IT Security

In today’s business world, technical information is increasingly—in many cases, almost exclusively—digital information, consisting of text, images, numerical data, and formulas stored and distributed electronically via computer networks. That means “information security” and “cybersecurity” are increasingly synonymous, which is why most organizations have made some sort of cybersecurity training for their employees mandatory. While that’s certainly wise, it shouldn’t be grounds for complacency, because “mandatory” and “some sort” are plainly not synonyms for “adequate” and “effective.”

In addition to providing and requiring cybersecurity awareness training for all employees, truly wise managers and administrators conduct regular internal assessments of security awareness to gauge how well their employees understand the nature and seriousness of the security risks and how well prepared they are to respond to cyber threats.

You can test your employees’ understanding of cybersecurity with a survey or questionnaire. Better yet—from the standpoint of accuracy, objectivity, and credibility — get help from qualified professionals in this critical area, and ask them to evaluate the effectiveness of your current cybersecurity awareness training as part of a comprehensive cybersecurity compliance risk assessment of your entire company.

Here are some very basic questions about cybersecurity that all your employees should be able to answer:

• Who in my company is responsible for cybersecurity?
• What are the policies and rules that govern my use of the company’s computer system and my access to electronically stored company information? Where can I read them? How can I stay current on changes to those policies and rules?
• If I suspect I have a cybersecurity issue (e.g., malware, spyware, a compromised password, a sensitive document sent to the wrong person, identity theft, evidence of a co-worker’s carelessness or failure to follow policies and procedures), to whom can I report it? If that person is temporarily unavailable, who is their backup? What should I do immediately to reduce potential damage?
• Does the company have a policy on bringing personal devices to the workplace and connecting to the company’s system through them? What about accessing the company’s system remotely from home, while traveling, or through an unsecured public network (e.g., coffee shop, library, hotel, university campus?
• In what ways could my actions (e.g., opening a malicious e-mail attachment, clicking on a link to a compromised website, installing an application that contains a Trojan) endanger the security of the company’s system and sensitive information? What are some things I can do to avoid these dangers?

Those are the easy questions—or rather, they should be. If your employees can’t answer them easily, then give that “mandatory employee awareness training” the failing grade it deserves, roll up your sleeves, and get to work on improving your company’s cybersecurity. Don’t hesitate to get outside help—qualified, professional help—if you need it.

According to a survey of hundreds of U.S. companies, conducted in 2015 by CompTIA, “human error” accounts for 52 percent of security breaches. Turns out it’s a greater cyber threat than malware, hackers, or disgruntled employees—although most managers are surprised when they hear this, and have a hard time believing it.

That recalls another category of “human error”—one that wasn’t included in CompTIA’s survey, though perhaps it should have been. It’s an extremely hazardous condition that our cybersecurity compliance risk assessment team has discovered at more than one facility they visited. If you’re a regular reader of this blog, I’m confident that this cyber hazard is not present at your company, so I offer the following on-site finding, straight from the company officer’s mouth, without further comment:

“I’m not sure our company even has a cybersecurity policy or plan or procedures yet. Do we really need anything like that? We’re not some giant corporation, you know. How would we go about creating such a policy? After all, none of us are techies!”  

You Need to Prioritize Cybersecurity Compliance in 2017

Two recent technological trends have made the job of safeguarding export-restricted information more challenging than ever before:

• The expansion of “cloud” services from simple file storage and archiving to business software applications of all kinds, infrastructure, and platforms.
• The proliferation of new mobile IT devices.

These advances in technology make it possible for people to access the data and resources of your organization at any time from anywhere on earth. In other words, not only is your business no longer tied to a single location, it’s not even limited to a finite number of locations. Your firm is Open for Business everywhere.

By allowing unprecedented levels of connectivity between marketing and R&D staff, contractors and subcontractors, manufacturers and suppliers, domestic and foreign offices, salespeople and customers around the globe, Cloud Computing and Mobile Technology promise to help businesses accelerate innovation cycles and reduce time-to-market. At the same time, the adoption of these technologies has created new vulnerabilities and risk areas, exposed enterprises to new legal liabilities, and raised a host of new security concerns, some of which are only beginning to emerge.

Meanwhile, in response to the overwhelming global cyber threat environment, the U.S. Government has been issuing more and more cybersecurity laws and regulations. The DoD, GSA, OMB, NASA, NARA, DHS, and the White House have published, amended, modified, and clarified so many rules, Executive Orders, definitions, standards, and guidelines recently—all of them aimed at requiring Federal contractors and subcontractors to establish more stringent controls and practices for the protection of government data—that “regulatory compliance” became the cybersecurity buzz phrase of the year during 2016, and the topic seems unlikely to leave the limelight in 2017.

The latest driver of regulatory compliance is the need for businesses to implement a somewhat bewildering array of new cybersecurity requirements that apply to most Federal contractors and consultants across a wide range of industries, including both defense and non-defense contractors. The recent surge in regulatory activity has included—

• A new FAR final rule on “Basic Safeguarding of Contractor Information Systems”).
• A new BIS final rule, effective September 1, 2016, allowing U.S. companies to use cloud technology and other means of electronic transmission to store and transfer EAR-controlled unclassified “dual use” technology and software without the burden of export control requirements if certain encryption requirements are met.
• A veritable glossary of new information security terms and definitions, including Federal Contract Information (FCI), Controlled Unclassified Information (CUI), covered contractor information system, Covered Defense Information (CDI), and operationally critical support, and an array of new safeguarding requirements associated with them.
• New mandatory contract clauses covering cybersecurity, with flowdown to subcontractors and certain other parties (FAR 52.204-21 and DFARS 252.204-7008 – 7012).
• A new DoD final rule, effective October 21, 2016, regarding network penetration reporting (“cyber incidents”) and contracting for cloud services (DFARS Case 2013-D018).

The above are just a few of the latest regulatory changes in this area. Others appear to be on the way as we head into the new year.

Putting all these rules and definitions together and figuring out which of them applies to your company and its products is a daunting task. Complying with the new regulations—minimizing your risks and liabilities—is an even greater challenge.

Businesses need be asking and finding answers to some important questions, such as—

• How will our firm comply with the new requirements, such as “adequate security” for CDI/CUI per NIST SP 800-171, and “incident reporting” within 72 hours of discovery through the DoD’s DIBNet portal (including compliance with all the rules for investigating, preserving, and submitting information about the data breach)?
• Do we try to handle cybersecurity regulatory compliance ourselves, do we seek the services of an outside IT contractor, or do we need some combination of both approaches?
• Since these new cybersecurity standards appear to be mind-bogglingly difficult to navigate and not entirely coherent, and since a failure to comply with them could have dramatic adverse consequences for our company, should we be looking at a specialized cyber insurance policy to supplement our general and professional liability policies?

The ultimate deadline for full contractor compliance with most of the new cybersecurity requirements for CDI/CUI is December 31, 2017, and that date is not likely to change. But the new cybersecurity regulations are already impacting businesses and contracts, especially those in the defense sector.

While DFARS clause 252.204-7012 allows you to notify the DoD (within 30 days) of any cybersecurity requirements that your company has yet implemented at the time of contract award, the DoD still expects you to be moving toward full compliance as rapidly as possible, and to have a remediation plan in place to achieve it by December 31, 2017.

So, if you haven’t already done the following at your company, you need to do them now:

• Conduct a risk assessment for cybersecurity regulatory compliance.
• Develop a cybersecurity action plan, based on the assessment findings.
• Implement a cybersecurity framework that is appropriate for your organization.

Note: For those who don’t keep up with the latest business jargon, a “framework” includes stuff like organizational infrastructure and job responsibilities; awareness and education programs; organizational culture; and governance (security policies; work processes and procedures; monitoring effectiveness; technical controls; risk assessments and audits; breach response and risk mitigation plans). “Implementing” a framework implies investing company resources in making it happen.

Whether your company is small, mid-sized, or large, if you do business with the Federal government, or with any other companies that do business with the Federal government — have I left anyone out here? — you should prioritize both regulatory compliance and cybersecurity during 2017.

Regulatory compliance is obligatory, of course, because . . . well, it’s the law, folks! But cyber-compliance is not the same as cyber-security, and security is what you really want.

If your goal is simply to avoid fines and penalties, then as long as you’re sure you meet the minimal requirements of compliance, don’t worry.

But if you’re reading this because your goal is to see your company survive and thrive in today’s digitally interconnected business world, and you’re aware of the current security threat landscape, you shouldn’t breathe easy if you’re told that your company is 100% compliant. Breathe easy when you’re confident that your company has good cybersecurity.

EXPORT COMPLIANCE IN 11 WORDS
A Series on Export Compliance Essentials

(Parts 5 & 6 of 12)

DOCUMENT & COMMUNICATE: SMALL STUFF THAT MATTERS

When it comes to export compliance, it’s often the little things that make a big difference. The reporting requirements of ITAR §122.4, for instance:  has your company already missed the 5-day deadline?

In a speech called “Elephants Don’t Bite!” motivational speaker Joel Weldon reminds his audiences that in the quest for excellence, it’s almost always the small stuff, the stuff that’s easy to miss, not the big stuff, that trips us up. “Raise your hand if you have ever been bitten by a mosquito,” he says. “Has anyone here been bitten by an elephant? . . . That proves my point! It’s the little things that get you, not the big things. The little things come along and cause big problems!” Then, on a more positive note, Weldon adds, “And it’s the little things you do right that can bring you huge rewards.” The moral: pay attention to details!

Among the myriad government rules and regulations for U.S. exporters, the requirements for recordkeeping and reporting might easily be taken for trivial matters. Evidently many companies do take them that way, because changes in the firm’s registration information that have never been reported to the DDTC—as required by ITAR §122.4, “Notification of Changes in Information Furnished by Registrants”— is one of the most common problems our visiting teams discover when they arrive at a client’s headquarters for an on-site risk assessment. And you can be sure that if folks from the State Department arrive at your firm under the Company Visit Program (CVP), as part of their Outreach efforts, they will spot this right away, too, and label it (correctly) as a failure to comply with the requirements of the ITAR.

Here’s the relevant portion of this regulatory requirement in ITAR §122.4 (as amended on August 26, 2013, effective October 25, 2013):

(a) A registrant must, within five days of the event, provide to the Directorate of Defense Trade Controls a written notification, signed by a senior officer (e.g., chief executive officer, president, secretary, partner, member, treasurer, general counsel), if . . .

(2) There is a change in the following information contained in the Statement of Registration:

(i) Registrant’s name;
(ii) Registrant’s address;
(iii) Registrant’s legal organizational structure;
(iv) Ownership or control.

When this section was last revised, in 2013, the State Department also revised ITAR §129.8, which deals with the registration and licensing requirements for brokers, to include some further notification requirements. Here’s the relevant portion of that part of the regulations:

(d) A registrant must, within five days of the event, provide to the Directorate of Defense Trade Controls a written notification, signed by a senior officer (e.g., chief executive officer, president, secretary, partner, member, treasurer, general counsel), if . . .

 (2) There is a change in the following information contained in the Statement of Registration (form DS–2032):

(i) Registrant’s name;
(ii) Registrant’s address;
(iii) Registrant’s legal organization structure;
(iv) Ownership or control;
(v) The establishment, acquisition or divestment of a U.S. or foreign subsidiary or other affiliate who is engaged in brokering activities or otherwise required to be listed in registrant’s Statement of Registration; or
(vi) Board of directors, senior officers, partners and owners.

And finally, here’s what the DDTC is currently saying on their web site about what the agency expects from registrants regarding notifications of changes “as part of the registration renewal process”:

[Registrants are instructed to] notify the Department of the following material changes as part of the registration renewal process: 1) consolidation of a broker registration with a manufacturer/exporter registration; 2) removal of entities not owned or otherwise controlled from registration; and 3) deletions or additions of U.S. Munitions List categories. However, if notification of change is the subject of an internal reorganization, merger, acquisition, or divestiture registrants must notify the Department of all changes in information within five days of the event, including where applicable, the three changes specified above.

The third type of change mentioned in this web notice, “deletions or additions of U.S. Munitions List categories,” is not specifically mentioned in the sections of the ITAR quoted above, but if the change your company is reporting is one involving an internal reorganization, merger, acquisition, or divestiture, you would be well advised to include any such changes in your within-five-days notification to the DDTC as well.

We trust you noted the requirement in all the above citations that these notifications need to be made to the DDTC within five days of the event. If you’re wondering whether that phrase means what it appears to mean, the answer is that it does.

If you’ve been thinking while reading the above that “within five days of the event” seems like an awfully narrow time window for notifying the DDTC of a change at your company, consider this: some required notifications must be made in advance of the event. One such prior reporting requirement—a critically important one, too, and an all-too-common source of violations, in our experience—is found in ITAR §122.4(b). This paragraph applies to any intended (that is, prospective or planned) sale, or transfer of ownership/control, of your business, or of “any entity thereof,” to a foreign party or parties. Here is the relevant passage (we’ve underlined for you a couple of crucial sentences that you might easily have missed, imagining perhaps (incorrectly) that they were “small stuff”):

(b) A registrant must notify the Directorate of Defense Trade Controls by registered mail at least 60 days in advance of any intended sale or transfer to a foreign person of ownership or control of the registrant or any entity thereof. Such notice does not relieve the registrant from obtaining the approval required under this subchapter for the export of defense articles or defense services to a foreign person, including the approval required prior to disclosing technical data. Such notice provides the Directorate of Defense Trade Controls with the information necessary to determine whether the authority of § 38(g)(6) of the Arms Export Control Act regarding licenses or other approvals for certain sales or transfers of defense articles or data on the U.S. Munitions List should be invoked (see §§ 120.10 and 126.1(e) of this subchapter).

(c) The new entity formed when a registrant merges with another company or acquires, or is acquired by, another company or a subsidiary or division of another company shall advise the Directorate of Defense Trade Controls of the following:

(1) The new firm name and all previous firm names being disclosed;

(2) The registration number that will survive and those that are to be discontinued (if any);

(3) The license numbers of all approvals on which unshipped balances will be shipped under the surviving registration number, since any license not the subject of notification will be considered invalid; and

(4) Amendments to agreements approved by the Directorate of Defense Trade Controls to change the name of a party to those agreements. The registrant must, within 60 days of this notification, provide to the Directorate of Defense Trade Controls a signed copy of an amendment to each agreement signed by the new U.S. entity, the former U.S. licensor and the foreign licensee. Any agreements not so amended will be considered invalid.

(d) Prior approval by the Directorate of Defense Trade Controls is required for any amendment making a substantive change.

We hope you noticed that, in addition to the mandatory notification that must be made to the State Department 60 days in advance (“must” and “shall” are such little words that they can easily be missed — “small stuff,” right? — but in government regulations they always translate as “mandatory” and “legally required”), there is also mention of a mandatory follow-up submission required by State no later than 60 days after the first. Any regulatory language that translates as “deadline,” whether the period specified is “before” or “after,” deserves to be underlined or highlighted; it comes under the heading of “small stuff that matters.”

“COMMUNICATE” is one of the 11 key words that we chose to summarize the essentials of export compliance in this blog series. A few synonyms for communicate are notify, report, and disclose. Notifying the State Department within 5 days of changes in your registration information is only one of the multiple notifications that are mandatory and must be made in a timely manner. Reporting semi-annually on your company’s use of the Canadian Exemption (ITAR §126.5), as specified in Supplement No. 1 to Part 126 of the ITAR, Note 14(c), is another example of a mandatory communication. (Don’t let that word “exemption” mislead you here; exemption from a license requirement doesn’t mean you are exempt from reporting and recordkeeping requirements!)  Disclosing information to the DDTC or BIS about a potential or actual export control violation (see ITAR §127.12) is sometimes legally mandatory—in which case neglecting to file such a disclosure would constitute an additional violation. But even when such disclosures are not mandated by law, and when they haven’t been “directed” or ordered by a government agency, they are very strongly encouraged by all the agencies and highly advisable in most cases, since voluntary disclosures will generally be a mitigating factor in determining what administrative penalties, if any, will be imposed.

Whatever synonym is used for it, the failure to communicate critical compliance information to the DDTC, BIS, or OFAC within a specified deadline is one of the most common sources of export violations, and the penalties that can result from such violations are by no means “small stuff”!

“DOCUMENT,” another of our 11 key compliance words, is closely related to what we have been talking about here. A synonym for documenting is creating and keeping records of your exports. Some very specific kinds of recordkeeping for export transactions are mandated by the ITAR, the EAR, and the various OFAC Sanctions programs. Not only do the legally required transaction and licensing records need to be complete, accurate, and secure, they need to kept for a certain time (in most cases, five years) and maintained in a certain way.

For example, ITAR §122.5 states that the information “must be stored in such a manner that none of it may be altered once it is initially recorded without recording all changes, who made them, and when they were made.” Have you checked to see whether your company’s current order processing or ERP software supports this critical ITAR requirement? And, if the software you use does have this tracking and recording capability, have you checked to verify that the feature is appropriately configured and “turned on”?

Another detail worth checking: ITAR §122.5 also says that your export records need to be “available at all times for inspection and copying” in case of a compliance audit or other official visit or investigation. Have you checked lately to see how “available” the legally mandated records are at your company? Which employees know how to access and retrieve them for inspection, if the occasion arises?

The DDTC, BIS, and OFAC most certainly do not consider a company’s failure to keep accurate and complete records of its export transactions, as required by law, to be a trivial matter, or “small stuff.”

In our experience, many companies have not clearly understood that compliance with these recordkeeping requirements is ultimately their responsibility, as the U.S. exporter, or USPPI, and that they cannot simply hand it off to a freight forwarder or shipping agent, and then forget about it. Even if you do employ the services of a third-party freight forwarder to ship your commodities, you still need to make sure that you receive and keep on file copies of all shipping documents, AES/ACE entries, supporting documents, special certifications, and all other required documentation for every export transaction. You should also be periodically checking and comparing the freight forwarder’s records against your purchase orders, invoices, export licenses, agreements, reports of exemption use, etc., to make sure that your exports are fully compliant with U.S. export laws and regulation. In the event of an official visit or compliance audit from one of the regulatory agencies, when the agents request the records of one of your export transactions, “I’m afraid I can’t help you with that; I imagine our freight forwarders must keep that sort of information on file somewhere” will not be an acceptable answer; you might be told that it is a synonym for “export violation.”