CUI category: Export Controlled (EXPT)

Export Controlled, marked EXPT, is the Controlled Unclassified Information (CUI) category for unclassified information whose export the law restricts. The CUI Registry page for Export Controlled, last reviewed May 8, 2025, describes it as unclassified information concerning items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect United States national security and nonproliferation objectives. The category sits in the Registry's Export Control index grouping next to Export Controlled Research. This page explains what the Registry lists, which authorities make a document Basic or Specified, how the Department of Defense (DoD) handles the category, and how it relates to the export-control warning on DoD technical data. For the program as a whole, see What is CUI?.

What the Registry says the category covers

The Registry's description is broad on purpose. After the sentence about national security and nonproliferation, the page says the category is "to include" dual use items; items identified in the Export Administration Regulations (EAR), the International Traffic in Arms Regulations (ITAR), and the munitions list; license applications; and sensitive nuclear technology information. So EXPT reaches two kinds of records: the technical data itself, such as a drawing or manual whose content falls on the United States Munitions List or the Commerce Control List, and the paperwork of the licensing system, such as a license application or an Electronic Export Information filing.

The page gives three banner forms. For Specified authorities the banner is CUI//SP-EXPT. For Basic authorities the banner is CUI, with CUI//EXPT as the alternative Basic banner an agency may use to show the category. The category marking EXPT appears on the Registry's category marking list, as do Export Controlled Research (EXPTR) and Controlled Technical Information (CTI).

Basic and Specified authorities on the EXPT page

Under 32 CFR 2002.4, paragraph (j), CUI Basic is the subset for which the authority sets no specific handling controls, and under paragraph (r) CUI Specified is the subset where it does. EXPT is both. The authority table has 15 rows, 8 Basic and 7 Specified, reproduced here as the page lists them.

The rule that follows is in 32 CFR 2002.20. Paragraph (b)(2) makes category markings mandatory for CUI Specified and optional for CUI Basic, and paragraph (b)(2)(iii) says the banner must carry every Specified category marking that pertains to the document. A designator who relies on 22 CFR 120.21 to protect a license application writes CUI//SP-EXPT; one who relies on 10 U.S.C. 130(a) to withhold technical data may write CUI or CUI//EXPT.

The first row needs a note. 50 U.S.C. 4614 was section 12 of the Export Administration Act of 1979, which the United States Code describes as relating to enforcement authority, and the Code now shows sections 4614 to 4621 as repealed by Public Law 115-232, section 1766(a), on August 13, 2018, the Export Control Reform Act. The Registry still lists the citation, and the EAR still points back to it: 15 CFR 748.1(c) opens with the words "Consistent with section 12(c) of the Export Administration Act." A holder who sees 50 U.S.C. 4614(c) on a designation indicator is looking at the old statutory label for a rule the EAR still carries.

The ITAR and EAR authorities

22 CFR 120.21, Disclosure of information, is the Specified ITAR authority. Paragraph (b) says information concerning license applications shall be withheld from public disclosure unless the Secretary of State determines release to be in the national interest, under section 38(e) of the Arms Export Control Act; the names of countries and the types and quantities of defense articles licensed are not withheld without a separate determination. Paragraph (d) names two disclosures already found to be in the national interest: to foreign governments for law enforcement or regulatory purposes, and within multilateral export regimes.

22 CFR 124.9(a)(5), a Basic authority, is a clause required only in manufacturing license agreements: an annual report of sales or other transfers of the licensed articles, by quantity, type, U.S. dollar value, and purchaser or recipient, goes to the Department of State, which deems those reports proprietary information that will not be disclosed to unauthorized persons. The Registry pairs it with 22 CFR 127.3, under which any person who willfully violates section 38 or 39 of the Arms Export Control Act, a rule under them, or an undertaking required by Part 124, or who makes an untrue statement of material fact in a registration, license application, or report, is on conviction subject to a fine or imprisonment or both as prescribed by 22 U.S.C. 2778(c).

The Specified EAR authorities protect the licensing record rather than the technology. Supplement No. 2 to 15 CFR Part 736, Administrative Orders, opens with Administrative Order One, Disclosure of License Issuance and Other Information: information the Department of Commerce obtains to consider license applications will not be publicly disclosed without the approval of the Secretary of Commerce, and Electronic Export Information filed through the Automated Export System is also exempt from public disclosure under section 301(g) of Title 13. 15 CFR 748.1(c), Confidentiality, says the same from the applicant's side, adding the Under Secretary for Industry and Security as an approving official. 13 U.S.C. 301(g), Basic, is the statute behind the declaration rule: Shippers' Export Declarations, or any successor document, wherever located, are exempt from public disclosure unless the Secretary determines the exemption would be contrary to the national interest.

The Registry keeps research separate. The Export Controlled Research category, marked EXPTR, has one Basic authority, 15 CFR 734.8(b). 15 CFR 734.8(a) says technology or software that arises from fundamental research and is intended to be published is not subject to the EAR, and Note 2 to that paragraph says that once a researcher or institution decides to keep results restricted or proprietary, the technology becomes subject to the EAR if it falls within 734.3(a).

The DoD and nuclear authorities

10 U.S.C. 130(a) lets the Secretary of Defense withhold from public disclosure, notwithstanding any other law, technical data with military or space application in DoD possession that may not be exported lawfully without approval under the Export Administration Act of 1979 or the Arms Export Control Act. The section carries its own limit: data may not be withheld if regulations under either Act authorize its export under a general, unrestricted license or exemption. Subsection (c) defines the technical data as blueprints, drawings, plans, instructions, computer software and documentation, or other technical information usable to design, engineer, produce, manufacture, operate, repair, overhaul, or reproduce military or space equipment. Public Law 98-94 added the section on September 24, 1983, as section 140c.

32 CFR 250.4(a) restates that authority as DoD policy, still citing 10 U.S.C. 140c. Paragraph (b) gives the reason: public disclosure of such data is tantamount to providing uncontrolled foreign access. Paragraph (c) says DoD policy is nonetheless to provide the data to currently qualified U.S. contractors for a legitimate business purpose. DoDD 5230.25, Withholding of Unclassified Technical Data From Public Disclosure, dated November 6, 1984 and incorporating Change 2 of October 15, 2018, is the directive behind Part 250; its paragraph 3.2 defines the qualified U.S. contractor as one that, under procedures the Under Secretary of Defense for Research and Engineering establishes, certifies as a condition of obtaining export-controlled technical data.

32 CFR 250.9, the Specified DoD authority, is a notice that travels with the data. Paragraph (a) says export of the information, which in some circumstances includes release to foreign nationals within the United States, without State or Commerce approval may violate the law. Paragraph (b) states the penalties as the regulation gives them: under 22 U.S.C. 2778, up to 2 years imprisonment or a fine of $100,000 or both; for EAR items, a fine of up to $1,000,000 or five times the value of the exports, or for an individual up to 10 years or $250,000. Those figures are older than current law: 22 U.S.C. 2778(c) now sets up to $1,000,000 or 20 years per violation, and 50 U.S.C. 4819(b), in the Export Control Reform Act, sets the same maximums for EAR violations. Paragraph (h) requires a copy of the notice with any reproduction of the data.

The Registry's phrase "sensitive nuclear technology information" points to the Atomic Energy Act rows. 42 U.S.C. 2077(a), Specified, bars transferring, receiving, owning, possessing, importing, or exporting special nuclear material without a Nuclear Regulatory Commission license. 42 U.S.C. 2168(a), Basic, directs the Secretary of Energy to prohibit unauthorized dissemination of unclassified information about the design and security of atomic energy defense facilities and about atomic weapons declassified from Restricted Data. Subsection (b), the listed sanction, sets a civil penalty of up to $100,000 per violation, which the Department of Energy's rule at 10 CFR 1017.29(c) now states as $337,966 after inflation adjustment, and subsection (c) makes a violation criminal under 42 U.S.C. 2273.

How DoD handles export controlled CUI under DoDI 5200.48

DoDI 5200.48, Controlled Unclassified Information, effective March 6, 2020, has no EXPT row in its Table 1 of DoD CUI Registry category examples, but it addresses export-controlled CUI in four places.

Paragraph 3.4.d covers dissemination controls. Subparagraph (2) says NOFORN or NF may be applied, when warranted, to unclassified CUI having a licensing or export control requirement, after a Foreign Disclosure Officer confirms no agreement prohibits it. Subparagraph (3) says REL TO may be applied to CUI with an export control or licensing requirement where a foreign disclosure agreement is in place, and subparagraph (3)(a) says export-controlled CUI transfers to foreign persons must follow the Arms Export Control Act, the ITAR, the Export Control Reform Act, the EAR, and DoDI 2040.02, with a positive foreign disclosure decision before release.

Paragraph 4.3 covers legacy distribution statements. Subparagraph b says DoD uses limited dissemination controls for new CUI documents except export controlled technical information, which must be marked with an export control warning in accordance with DoDI 5230.24, DoDD 5230.25, and 32 CFR Part 250, and subparagraph c repeats that such information still uses distribution statements. Table 2 shows that Distribution Statement X was cancelled and superseded by Distribution Statement C. Paragraph 3.9.d adds that unauthorized disclosure of export controlled technical data may bring civil and criminal sanctions.

Paragraph 3.4.g explains why a DoD document may lack SP-: during initial phased implementation DoD made no required distinction between Basic and Specified and promised later guidance, so a DoD designation indicator may read CUI Category: EXPT where the Registry would call the authority Specified.

The export-control warning under DoDI 5230.24

DoDI 5230.24, Distribution Statements on DoD Technical Information, effective January 10, 2023, is where the export question is decided for technical documents. Paragraph 3.1.g says Distribution Statement X has been cancelled and that former Statement X information displays Statement C with export control as the reason. Paragraph 3.1.h lists export controls as a selection factor and names the sources: DoDD 5230.25, Parts 120 through 130 of Title 22 (the ITAR), Parts 730 through 774 of Title 15 (the EAR), and Parts 110 and 810 of Title 10.

Paragraph 3.4.h puts the designation decision on the controlling DoD office, which determines whether technical information contains export-controlled technical information using DoDD 5230.25, the ITAR, and the EAR. Paragraph 3.4.i then requires the marking: all information found to contain export-controlled technical information gets the warning in paragraph 4.3.e.(2), Distribution Statement B, C, D, or E with Export Controlled as a reason, and the notice to accompany export-controlled data under DoDD 5230.25.

Paragraph 4.3.e is the Export Controlled defense category. Subparagraph (1) says information marked Statement C or D will not go outside the U.S. Government or to its contractors without verifying the recipient's current DD Form 2345, Militarily Critical Technical Data Agreement. Subparagraph (2) requires the Figure 3 warning on all printed and electronic technical information found to contain export-controlled technical information. Figure 3 reads, in part, "WARNING - This document contains technical data whose export is restricted" by the Arms Export Control Act or the Export Control Reform Act of 2018. Subparagraph (3) names Statements B, C, D, E, or F, or REL TO, as the authorized export-control distribution statements.

The warning is not a CUI marking. 32 CFR 2002.20(b)(2)(iii) says that where law or regulation requires warning or distribution statements, agencies use them but must not include them in the CUI banner or portion markings. The history of the warning's wording and the recordkeeping rules that go with it are on the export-control warning page.

Portion marking and decontrol

Portion marking is optional for CUI in an unclassified document. Paragraph (f)(1) of 32 CFR 2002.20 says agencies are permitted and encouraged to portion mark all CUI, and paragraph (f)(3) gives the elements: the acronym CUI, category or subcategory markings if required or permitted, and limited dissemination control markings. The CUI Marking Handbook, Version 1.1 of December 6, 2016, gives the format: markings in parentheses at the beginning of the portion, the category separated from CUI by a double forward slash, and (U) on a portion with no CUI. A Specified export-controlled paragraph is marked (CUI//SP-EXPT), a Basic one (CUI) or (CUI//EXPT), and a NOFORN one (CUI//SP-EXPT//NF), since the Registry's limited dissemination page gives NF as the NOFORN portion marking. If a portion mark carries a category, the banner must carry it too. DoDI 5200.48 paragraph 3.4.b narrows DoD practice to (CUI) on every portion known to contain CUI and (U) on the rest. The export warning and the distribution statement never appear inside a portion mark.

32 CFR 2002.18 governs decontrol. Paragraph (a) says agencies should decontrol as soon as practicable any CUI that no longer requires controls unless the governing authority says otherwise. Paragraph (b) lists the automatic triggers: the law or regulation no longer requires control, the agency releases the information to the public, the agency discloses it under an access statute as part of its public release process, or a pre-set date or event occurs. Paragraph (e) says decontrol is not authorization for public release, and paragraph (j) says unauthorized disclosure is not decontrol.

For export-controlled information the first trigger is the usual one. 10 U.S.C. 130(a) withdraws the withholding authority when export regulations authorize export under a general, unrestricted license or exemption, and 15 CFR 734.8 removes technology from the EAR when it arises from fundamental research intended for publication. On the DoD side, DoDI 5200.48 requires a formal review under DoDI 5230.09 before CUI is decontrolled or released. Decontrol follows an export jurisdiction review, not a date.

Common confusions with neighboring categories

EXPT and CTI overlap but are not the same. The Controlled Technical Information category is Specified, marked CUI//SP-CTI, and rests on one authority, DFARS 252.204-7012, which defines CTI as technical information with military or space application that would meet the criteria for Distribution Statements B through F under DoDI 5230.24. CTI is about controls on access and distribution; EXPT is about export law. Much DoD technical data is both, and DoDI 5230.24 Figure 1 shows a designation indicator listing two categories at once.

EXPT is not EXPTR. Export Controlled Research is Basic, has one EAR authority, and covers research results that have not been restricted; once they are, Note 2 to 15 CFR 734.8(a) says they become subject to the EAR.

Export controlled is not a classification level. Paragraph (h) of 32 CFR 2002.4 excludes classified information from CUI, and DoDI 5200.48 paragraph 3.7.c says CTI that becomes classified through compilation or aggregation is subject to the National Industrial Security Program instead.

CUI//SP-EXPT and CUI//EXPT differ by authority, not sensitivity. The Marking Handbook says Specified is not a higher level of CUI, only different; the SP- form tells the holder that the underlying regulation, such as 22 CFR 120.21 or 32 CFR 250.9, carries its own handling rule. And the banner, the distribution statement, and the export warning do three different jobs, which is why DoDI 5200.48 and 32 CFR 2002.20 keep them separate on the page.

What to check

• Which EXPT authority does the designation indicator or agency policy rely on, and does the Registry list that authority as Basic or Specified?
• If the banner reads CUI//SP-EXPT, does every portion marking that carries a category also carry SP-EXPT, and does the banner carry every category that appears in a portion?
• For DoD technical information, does the document carry the Figure 3 warning, a Distribution Statement B, C, D, or E with Export Controlled as a reason, and the 32 CFR 250.9 notice?
• Before releasing to a contractor, is there a current DD Form 2345 on file, as DoDI 5230.24 paragraph 4.3.e requires for Statement C or D material?
• Before releasing to a foreign person or marking REL TO, has a Foreign Disclosure Officer made the positive disclosure decision that DoDI 5200.48 paragraph 3.4.d requires?
• Is the information still export controlled, or does an exemption, a general license, or the fundamental research rule in 15 CFR 734.8 mean 32 CFR 2002.18 calls for decontrol?

Azcuna's TRACE is one offline viewer for S1000D, MIL-STD-3001 XML, and PDF technical manuals. It keeps the source location and the markings of everything it shows and never modifies the source. It was proposed to NAVAIR under Navy SBIR Phase I topic DON26BZ05-NV078, and the proposal was submitted on September 23, 2026.

Questions people ask

What is export controlled CUI?

Export Controlled is a CUI Registry category, marked EXPT, for unclassified information about items, commodities, technology, software, or other information whose export could reasonably be expected to adversely affect United States national security and nonproliferation objectives. The Registry page says it includes dual use items, items identified in the Export Administration Regulations, the International Traffic in Arms Regulations and the munitions list, license applications, and sensitive nuclear technology information.

What does CUI//SP-EXPT mean?

CUI//SP-EXPT is the banner marking for Export Controlled information designated under one of the category's Specified authorities. The Registry page lists 7 Specified authorities for EXPT, including 22 CFR 120.21, 15 CFR 748.1(c), 15 CFR 736 Supplement No. 2, 42 U.S.C. 2077(a), and 32 CFR 250.9. Under 32 CFR 2002.20(b)(2), Specified category markings must appear in the banner, so SP-EXPT cannot be dropped from a document designated under them.

What is the EXPT marking?

EXPT is the Registry's category marking for Export Controlled. On a document designated under a Basic authority the banner is CUI, or CUI//EXPT if the agency chooses to show the category. On a document designated under a Specified authority the banner is CUI//SP-EXPT. The Registry's category marking list, which carries the same abbreviation, is the only approved source for category markings under 32 CFR 2002.20.

Is export controlled information classified?

No. Export Controlled is a CUI category, and 32 CFR 2002.4 defines CUI as unclassified information that a law, regulation, or Government-wide policy requires or permits an agency to control. The export laws restrict who may receive technical data and where it may go, which is why it needs controls, but the information itself is not classified under Executive Order 13526 or the Atomic Energy Act.

Is ITAR technical data CUI?

When an agency holds it, or a contractor holds it for an agency, yes. The Registry's Export Controlled page names ITAR items and license applications in its description and lists 22 CFR 120.21 as a Specified authority and 22 CFR 124.9(a)(5) as a Basic authority with 22 CFR 127.3 as its sanction. DoDI 5200.48 adds that export-controlled CUI transfers to foreign persons must follow the Arms Export Control Act, the ITAR, the Export Control Reform Act, and the EAR.

What is the difference between EXPT and CTI?

Controlled Technical Information (CTI) is a separate Specified category whose single authority is DFARS 252.204-7012; that clause defines CTI as technical information with military or space application that would carry Distribution Statement B through F under DoDI 5230.24. EXPT rests on the export laws and regulations. The same drawing can qualify for both, and DoDI 5230.24's Figure 1 shows a designation indicator listing more than one CUI category.

Does export controlled CUI need the export control warning?

In the Department of Defense, yes, for technical information. Paragraph 3.4.i of DoDI 5230.24, effective January 10, 2023, says all information found to contain export-controlled technical information will be marked with the Figure 3 warning and assigned Distribution Statement B, C, D, or E with Export Controlled as a reason. DoDI 5200.48 says the warning is used in place of a limited dissemination control for export-controlled technical information.

Who can receive export controlled technical data from DoD?

DoDI 5230.24 paragraph 4.3.e says export-controlled technical information marked with Distribution Statement C or D will not go outside the U.S. Government or to Government contractors without verifying a current DD Form 2345, Militarily Critical Technical Data Agreement, under DoDD 5230.25. That directive defines a qualified U.S. contractor as one that certifies, under procedures the Under Secretary of Defense for Research and Engineering establishes, as a condition of receiving the data.

When is export controlled CUI decontrolled?

Under 32 CFR 2002.18, an agency may decontrol CUI when the governing law or regulation no longer requires control, when it releases the information to the public, or when a set date or event occurs. For technical data, 10 U.S.C. 130(a) says data may not be withheld if export regulations authorize export under a general, unrestricted license or exemption, and 15 CFR 734.8 says technology that arises from fundamental research intended for publication is not subject to the EAR.

Sources

1. 1Export Controlled (CUI Registry category) · National Archives, Information Security Oversight Office
2. 2Export Controlled Research (CUI Registry category) · National Archives, Information Security Oversight Office
3. 3Controlled Technical Information (CUI Registry category) · National Archives, Information Security Oversight Office
4. 4CUI Registry: Category Markings · National Archives, Information Security Oversight Office
5. 5CUI Marking Handbook, Version 1.1, December 6, 2016 · National Archives, Information Security Oversight Office
6. 632 CFR 2002.4 Definitions · GovInfo, U.S. Government Publishing Office
7. 732 CFR 2002.18 Decontrolling · GovInfo, U.S. Government Publishing Office
8. 832 CFR 2002.20 Marking · GovInfo, U.S. Government Publishing Office
9. 922 CFR 120.21 Disclosure of information · GovInfo, U.S. Government Publishing Office
10. 1022 CFR 124.9 Additional clauses required only in manufacturing license agreements · GovInfo, U.S. Government Publishing Office
11. 1122 CFR 127.3 Penalties for violations · GovInfo, U.S. Government Publishing Office
12. 1215 CFR Part 736 General Prohibitions, including Supplement No. 2, Administrative Orders · GovInfo, U.S. Government Publishing Office
13. 1315 CFR 748.1 General provisions · GovInfo, U.S. Government Publishing Office
14. 1415 CFR 734.8 Technology or software that arises during, or results from, fundamental research · GovInfo, U.S. Government Publishing Office
15. 1510 U.S.C. 130 Authority to withhold from public disclosure certain technical data · GovInfo, U.S. Government Publishing Office
16. 1632 CFR 250.4 Policy · GovInfo, U.S. Government Publishing Office
17. 1732 CFR 250.9 Notice to accompany the dissemination of export-controlled technical data · GovInfo, U.S. Government Publishing Office
18. 1842 U.S.C. 2168 Dissemination of unclassified information · GovInfo, U.S. Government Publishing Office
19. 1942 U.S.C. 2077 Unauthorized dealings in special nuclear material · GovInfo, U.S. Government Publishing Office
20. 2013 U.S.C. 301 Collection and publication · GovInfo, U.S. Government Publishing Office
21. 2150 U.S.C. 4614 to 4621, Repealed · GovInfo, U.S. Government Publishing Office
22. 2248 CFR 252.204-7012 Safeguarding covered defense information and cyber incident reporting · GovInfo, U.S. Government Publishing Office
23. 23CUI Registry: Limited Dissemination Controls · National Archives, Information Security Oversight Office
24. 2422 U.S.C. 2778 Control of arms exports and imports · GovInfo, U.S. Government Publishing Office
25. 2550 U.S.C. 4819 Penalties · GovInfo, U.S. Government Publishing Office
26. 2610 CFR 1017.29 Civil penalty · Electronic Code of Federal Regulations
27. 27DoD Instruction 5200.48, Controlled Unclassified Information (CUI), March 6, 2020 · Department of Defense, Directives Division
28. 28DoD Instruction 5230.24, Distribution Statements on DoD Technical Information, January 10, 2023 · Department of Defense, Directives Division
29. 29DoD Directive 5230.25, Withholding of Unclassified Technical Data From Public Disclosure, November 6, 1984, incorporating Change 2, October 15, 2018 · Department of Defense, Directives Division

Where this shows up in our work

• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.