You may be subject to and criminal penalties for unlawful export and disclosure of export-controlled information. If the results of the research become entangled with export-controlled information, it could delay or prevent publication of the results, and could result in loss of fundamental research qualification, which could result in additional restrictions and violations. ITAR/EAR Export Controlled Data ITAR or EAR Export-controlled information, referred to as Controlled Information in this document, stored at MIT should be managed in accordance with the following guidelines. IS&T Services IS&T provides several services at no-cost that may help individuals responsible for Controlled Information to secure its storage, access, and destruction. Please contact for more information. Security software, including Sophos Antivirus and Crowdstrike Falcon, a cloud-based anti-malware platform monitored in real-time by trained security professionals. Membership in the IS&T-managed active directory domain, providing Kerberos authentication, regular security patches, and two-factor authentication where appropriate. A managed hosting environment, providing domain membership as well as a managed system to hold Controlled Information in a secure and monitored environment. Data Access Controlled Information should not be accessed from shared or public computers such as computers in libraries, hotels, and business centers. Systems with access to Controlled Information should be well-maintained (patched/updated regularly) and run security software to detection malware or compromise. Access to Controlled Information should be provided to individuals on a to know” basis and in accordance with “need rules governing who is restricted from access (nationality, etc.). Protect Controlled Information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control. Data Storage Controlled Information must be stored on devices and access controlled with individually-assigned accounts requiring username/password or user certificates. Two-factor authentication should be enforced for access to highly sensitive data. All Controlled Information must be encrypted if stored on laptops, mobile devices (smartphones, tablets), or removable media (USB drives, CD/DVD). Cloud-based storage platforms, such as Dropbox or OneDrive, may be acceptable for some forms of Controlled Information with Export Office approval.
You may be subject to and criminal penalties for unlawful export and disclosure of export-controlled information. If the results of the research become entangled with export-controlled information, it could delay or prevent publication of the results, and could result in loss of fundamental research qualification, which could result in additional restrictions and violations. ITAR/EAR Export Controlled Data ITAR or EAR Export-controlled information, referred to as Controlled Information in this document, stored at MIT should be managed in accordance with the following guidelines. IS&T Services IS&T provides several services at no-cost that may help individuals responsible for Controlled Information to secure its storage, access, and destruction. Please contact for more information. Security software, including Sophos Antivirus and Crowdstrike Falcon, a cloud-based anti-malware platform monitored in real-time by trained security professionals. Membership in the IS&T-managed active directory domain, providing Kerberos authentication, regular security patches, and two-factor authentication where appropriate. A managed hosting environment, providing domain membership as well as a managed system to hold Controlled Information in a secure and monitored environment. Data Access Controlled Information should not be accessed from shared or public computers such as computers in libraries, hotels, and business centers. Systems with access to Controlled Information should be well-maintained (patched/updated regularly) and run security software to detection malware or compromise. Access to Controlled Information should be provided to individuals on a “need to know” basis and in accordance with rules governing who is restricted from access (nationality, etc.). Protect Controlled Information by at least one physical or electronic barrier (e.g., locked container or room, login and password) when not under direct individual control. Data Storage Controlled Information must be stored on devices and access controlled with individually-assigned accounts requiring username/password or user certificates. Two-factor authentication should be enforced for access to highly sensitive data. All Controlled Information must be encrypted if stored on laptops, mobile devices (smartphones, tablets), or removable media (USB drives, CD/DVD). Cloud-based storage platforms, such as Dropbox or OneDrive, may be acceptable for some forms of Controlled Information with Export Office approval.
technology-control-template-2017-06-30.docx