Skip to content

Encryption

Jump to bottom
mrdulasolutions edited this page Apr 23, 2026 · 1 revision

Encryption (ENC / 5x992)

Skill name: exchek-encryption | Folder: exchek-skill-encryption

Assists with 5A992/5D992 (and related 5A002, 5D002, 5E002) encryption classification under CCL Category 5 Part 2. Covers mass market eligibility (Note 3), License Exception ENC (§ 740.17), TSR, and TSU. Determines when BIS/NSA notification or the annual self-classification report is required and what to prepare. Prep only — no actual filing. Free; optional donation.

When to use

  • "Is this 5A992 or 5A002?"
  • "Do we need to notify BIS for this encryption product?"
  • "Walk me through License Exception ENC for our software"
  • "Mass market encryption classification and what we need to report"
  • "Annual self-classification report required for this?"
  • "ENC(b)(1) or ENC(b)(2) — which applies?"

Inputs

Field Required Notes
Product / item description Yes Hardware or software, encryption functionality, use case
Current or proposed ECCN No 5A992, 5D992, 5A002, 5D002, etc. if known
Destination No Or "general" for notification/report logic
Prior BIS registration / report No If already filed

Accepts pasted text or references to prior classification memos.

Key concepts

ECCN categories

ECCN What it covers
5A992 Encryption hardware — mass market eligible
5D992 Encryption software — mass market eligible
5A002 Encryption hardware — controlled (not mass market)
5D002 Encryption software — controlled (not mass market)
5E002 Encryption technology — controlled

Mass market (Note 3 to Category 5 Part 2)

Items meeting mass market criteria (generally available to the public, sold in volume, not designed for restricted end uses) may qualify as 5A992.c or 5D992.c rather than 5A002/5D002. The skill evaluates eligibility based on key length, availability, and end-use.

License Exception ENC (§ 740.17)

Sub-paragraph Who qualifies
ENC(a) Mass market items (after eligibility determination)
ENC(b)(1) Items sent to certain end users in most countries
ENC(b)(2) Items sent to certain government end users
ENC(b)(3) Items for specific limited uses

Notification and reporting

Obligation Trigger
BIS/NSA notification Required for certain ENC(b)(1) items before first export
Annual self-classification report Required for mass market 5A992.c / 5D992.c items and certain others

The skill determines which apply and helps prepare the data. No actual submission is made.

Flow

Step 0 — CUI/Classified check Asks whether the work involves CUI or classified material. If yes, routes to on-prem guidance. See CUI and Classified Information.

Step 1 — Report folder and format In file-access environments, asks where to save the memo and preferred format.

Step 2 — Collect inputs Gathers product description, encryption function, hardware vs. software, key length, current/proposed ECCN, destination, and prior filings.

Step 3 — Classification and ENC/TSR Applies Category 5 Part 2 criteria to conclude:

  • Recommended ECCN (5A992, 5D992, 5A002, 5D002, 5E002)
  • Mass market (Note 3) and TSU eligibility
  • License Exception ENC eligibility and applicable sub-paragraph
  • TSR applicability

Step 4 — Notification and reporting Determines: BIS/NSA notification required? Annual self-classification report required? Prepares what to include — no filing.

Step 5 — Build and save memo Fills the Encryption Classification and Notification Memo template (7 sections) and produces a .docx.

Output: Encryption Classification and Notification Memo

Sections:

  1. Document header
  2. Product / item summary
  3. Classification (ECCN conclusion, mass market analysis)
  4. License Exception ENC / TSR (eligibility and sub-paragraph)
  5. Notification and reporting obligations (prep only)
  6. Next steps
  7. AI tool disclosure

File name: ExChek-Encryption-YYYY-MM-DD-ShortName.docx

Regulatory references

  • 15 CFR Part 742, § 742.15 — Encryption controls
  • 15 CFR Part 740, § 740.17 — License Exception ENC
  • 15 CFR Part 740, § 740.6 — License Exception TSR
  • CCL Category 5 Part 2 — Information Security
  • Note 3 to Category 5 Part 2 — Mass market criteria
  • BIS Encryption page — https://www.bis.doc.gov/encryption

API data: GET https://api.exchek.us/api/ecfr/742 and GET https://api.exchek.us/api/ecfr/742/search?q=encryption

Skills to use with this one

Step Skill
Full item classification (not just encryption) ECCN Classification
Determine license requirement License Determination
Score overall transaction risk Risk Triage

Notes

  • Prep only. The skill prepares notification and report data but does not submit to BIS or NSA.
  • Not a formal CCATS. For formal BIS commodity classification (CCATS), contact BIS directly.
  • Recommend counsel for high-stakes or ambiguous cases — encryption export controls carry significant penalties.

Clone this wiki locally