Guidance for Creating Access Control Plans

Background

Each National Oceanic and Atmospheric Administration (NOAA) facility must have an “Access Control Plan” that identifies all of the measures and procedures that have been implemented at that facility to control foreign nationals’ access to technology that is regulated under the Export Administration Regulations (EAR), and that demonstrates that the facility has instituted sufficient measures and procedures to assure full compliance with the EAR. Every facility that has been assessed for EAR-controlled technology must create an Access Control plan that documents the findings of the controlled technology assessment. Even if there is no controlled technology at the facility, one must document that no controlled technology was found at the facility. If there is EAR-controlled technology at the facility, the Access Control plant must include the measures implemented to safeguard the technology

An Access Control Plan is not a one-size-fits-all document. Each facility must look at its particular circumstances and take appropriate steps to control access to EAR-controlled technology based on site-specific factors such as physical layout of the facility, locations of EAR-controlled technology within the facility, proximity of the facility to other parts of NOAA and other entities, security measures already in place or that will be put in place for reasons other than export control, duties and home country of foreign nationals working at the facility, and the frequency and home country of foreign national visitors at the facility.

Please review the guidance and sample plans to develop your facility's access control plan.