bmad-plus 0.8.0 → 0.9.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (213) hide show
  1. package/CHANGELOG.md +45 -1
  2. package/LICENSE +21 -21
  3. package/README.md +107 -85
  4. package/osint-agent-package/README.md +88 -88
  5. package/osint-agent-package/SETUP_KEYS.md +108 -108
  6. package/osint-agent-package/agents/osint-investigator.md +80 -80
  7. package/osint-agent-package/install.ps1 +87 -87
  8. package/osint-agent-package/install.sh +76 -76
  9. package/osint-agent-package/skills/bmad-osint-investigate/SKILL.md +147 -147
  10. package/osint-agent-package/skills/bmad-osint-investigate/osint/references/enrichment-databases-fr.md +148 -148
  11. package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/_http.py +101 -101
  12. package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/apify.py +266 -266
  13. package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/brightdata.py +101 -101
  14. package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/diagnose.py +141 -141
  15. package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/exa.py +79 -79
  16. package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/jina.py +71 -71
  17. package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/parallel.py +85 -85
  18. package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/perplexity.py +102 -102
  19. package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/tavily.py +72 -72
  20. package/osint-agent-package/skills/bmad-osint-investigate/osint/scripts/volley.py +208 -208
  21. package/osint-agent-package/skills/bmad-osint-investigator/SKILL.md +15 -15
  22. package/package.json +30 -3
  23. package/readme-international/README.de.md +18 -5
  24. package/readme-international/README.es.md +40 -12
  25. package/readme-international/README.fr.md +36 -8
  26. package/src/bmad-plus/agents/agent-architect-dev/SKILL.md +96 -96
  27. package/src/bmad-plus/agents/agent-architect-dev/bmad-skill-manifest.yaml +13 -13
  28. package/src/bmad-plus/agents/agent-maker/SKILL.md +201 -201
  29. package/src/bmad-plus/agents/agent-maker/bmad-skill-manifest.yaml +13 -13
  30. package/src/bmad-plus/agents/agent-orchestrator/SKILL.md +137 -137
  31. package/src/bmad-plus/agents/agent-orchestrator/bmad-skill-manifest.yaml +13 -13
  32. package/src/bmad-plus/agents/agent-quality/SKILL.md +83 -83
  33. package/src/bmad-plus/agents/agent-quality/bmad-skill-manifest.yaml +13 -13
  34. package/src/bmad-plus/agents/agent-shadow/SKILL.md +71 -71
  35. package/src/bmad-plus/agents/agent-shadow/bmad-skill-manifest.yaml +13 -13
  36. package/src/bmad-plus/agents/agent-strategist/SKILL.md +80 -80
  37. package/src/bmad-plus/agents/agent-strategist/bmad-skill-manifest.yaml +13 -13
  38. package/src/bmad-plus/data/role-triggers.yaml +209 -209
  39. package/src/bmad-plus/module-help.csv +10 -10
  40. package/src/bmad-plus/packs/pack-memory/README.md +106 -106
  41. package/src/bmad-plus/packs/pack-memory/memory-orchestrator.md +79 -79
  42. package/src/bmad-plus/packs/pack-memory/shared/karpathy-guardrails.md +86 -86
  43. package/src/bmad-plus/packs/pack-memory/shared/memory-protocol.md +143 -143
  44. package/src/bmad-plus/packs/pack-memory/templates/context.md +39 -39
  45. package/src/bmad-plus/packs/pack-memory/templates/decisions.md +25 -25
  46. package/src/bmad-plus/packs/pack-memory/templates/identity.yaml +39 -39
  47. package/src/bmad-plus/packs/pack-memory/templates/lessons.md +31 -31
  48. package/src/bmad-plus/packs/pack-memory/templates/patterns.md +24 -24
  49. package/src/bmad-plus/packs/pack-memory/templates/session-handoff.md +25 -25
  50. package/src/bmad-plus/packs/pack-memory/zecher-agent.md +157 -157
  51. package/src/bmad-plus/packs/pack-seo/bmad-skill-manifest.yaml +13 -0
  52. package/src/bmad-plus/packs/pack-shield/README.md +110 -110
  53. package/src/bmad-plus/packs/pack-shield/SKILL.md +82 -0
  54. package/src/bmad-plus/packs/pack-shield/categories/accessibility-esg/csrd-agent.md +251 -251
  55. package/src/bmad-plus/packs/pack-shield/categories/accessibility-esg/section508-agent.md +168 -168
  56. package/src/bmad-plus/packs/pack-shield/categories/accessibility-esg/wcag-agent.md +190 -190
  57. package/src/bmad-plus/packs/pack-shield/categories/ai-governance/eu-ai-act-agent.md +86 -86
  58. package/src/bmad-plus/packs/pack-shield/categories/ai-governance/iso42001-agent.md +240 -240
  59. package/src/bmad-plus/packs/pack-shield/categories/ai-governance/nist-ai-rmf-agent.md +122 -122
  60. package/src/bmad-plus/packs/pack-shield/categories/cybersecurity/cis-controls-agent.md +210 -210
  61. package/src/bmad-plus/packs/pack-shield/categories/cybersecurity/ism-agent.md +139 -139
  62. package/src/bmad-plus/packs/pack-shield/categories/cybersecurity/iso27001-agent.md +156 -156
  63. package/src/bmad-plus/packs/pack-shield/categories/cybersecurity/nis2-agent.md +72 -72
  64. package/src/bmad-plus/packs/pack-shield/categories/cybersecurity/nist-800-53-agent.md +239 -239
  65. package/src/bmad-plus/packs/pack-shield/categories/cybersecurity/nist-csf-agent.md +207 -207
  66. package/src/bmad-plus/packs/pack-shield/categories/data-privacy/ccpa-agent.md +94 -94
  67. package/src/bmad-plus/packs/pack-shield/categories/data-privacy/dpdpa-agent.md +136 -136
  68. package/src/bmad-plus/packs/pack-shield/categories/data-privacy/gdpr-agent.md +296 -296
  69. package/src/bmad-plus/packs/pack-shield/categories/data-privacy/iso27701-agent.md +134 -134
  70. package/src/bmad-plus/packs/pack-shield/categories/data-privacy/lgpd-agent.md +129 -129
  71. package/src/bmad-plus/packs/pack-shield/categories/defense-export/cmmc-agent.md +116 -116
  72. package/src/bmad-plus/packs/pack-shield/categories/defense-export/ear-agent.md +261 -261
  73. package/src/bmad-plus/packs/pack-shield/categories/defense-export/itar-agent.md +191 -191
  74. package/src/bmad-plus/packs/pack-shield/categories/defense-export/tsa-agent.md +356 -356
  75. package/src/bmad-plus/packs/pack-shield/categories/industry-compliance/dora-agent.md +499 -499
  76. package/src/bmad-plus/packs/pack-shield/categories/industry-compliance/fedramp-agent.md +236 -236
  77. package/src/bmad-plus/packs/pack-shield/categories/industry-compliance/hipaa-agent.md +162 -162
  78. package/src/bmad-plus/packs/pack-shield/categories/industry-compliance/pci-dss-agent.md +228 -228
  79. package/src/bmad-plus/packs/pack-shield/categories/industry-compliance/soc2-agent.md +255 -255
  80. package/src/bmad-plus/packs/pack-shield/categories/industry-compliance/swift-csp-agent.md +153 -153
  81. package/src/bmad-plus/packs/pack-shield/categories/workflows/ai-act-classifier.md +131 -131
  82. package/src/bmad-plus/packs/pack-shield/categories/workflows/ai-act-fria.md +155 -155
  83. package/src/bmad-plus/packs/pack-shield/categories/workflows/ai-act-incidents.md +187 -187
  84. package/src/bmad-plus/packs/pack-shield/categories/workflows/ai-act-roles.md +113 -113
  85. package/src/bmad-plus/packs/pack-shield/categories/workflows/breach-sentinel.md +197 -197
  86. package/src/bmad-plus/packs/pack-shield/categories/workflows/cookie-policy-gen.md +180 -180
  87. package/src/bmad-plus/packs/pack-shield/categories/workflows/dpia-sentinel.md +235 -235
  88. package/src/bmad-plus/packs/pack-shield/categories/workflows/legitimate-interest.md +159 -159
  89. package/src/bmad-plus/packs/pack-shield/categories/workflows/privacy-advisor.md +133 -133
  90. package/src/bmad-plus/packs/pack-shield/categories/workflows/privacy-notice-gen.md +160 -160
  91. package/src/bmad-plus/packs/pack-shield/categories/workflows/privacy-policy-gen.md +135 -135
  92. package/src/bmad-plus/packs/pack-shield/references/ccpa/ccpa-gdpr-comparison.md +117 -117
  93. package/src/bmad-plus/packs/pack-shield/references/ccpa/consumer-rights-workflows.md +177 -177
  94. package/src/bmad-plus/packs/pack-shield/references/cis-controls/framework-mappings.md +162 -162
  95. package/src/bmad-plus/packs/pack-shield/references/cis-controls/implementation-guidance.md +235 -235
  96. package/src/bmad-plus/packs/pack-shield/references/cis-controls/safeguards-detail.md +252 -252
  97. package/src/bmad-plus/packs/pack-shield/references/cmmc/cmmc-assessment.md +170 -170
  98. package/src/bmad-plus/packs/pack-shield/references/cmmc/cmmc-levels.md +113 -113
  99. package/src/bmad-plus/packs/pack-shield/references/cmmc/cmmc-practices.md +211 -211
  100. package/src/bmad-plus/packs/pack-shield/references/csrd/compliance-program.md +281 -281
  101. package/src/bmad-plus/packs/pack-shield/references/csrd/double-materiality.md +253 -253
  102. package/src/bmad-plus/packs/pack-shield/references/csrd/esrs-standards.md +401 -401
  103. package/src/bmad-plus/packs/pack-shield/references/dora/article-reference.md +441 -441
  104. package/src/bmad-plus/packs/pack-shield/references/dora/incident-classification.md +297 -297
  105. package/src/bmad-plus/packs/pack-shield/references/dora/rts-its-guide.md +306 -306
  106. package/src/bmad-plus/packs/pack-shield/references/dora/third-party-risk.md +349 -349
  107. package/src/bmad-plus/packs/pack-shield/references/dpdpa/gdpr-comparison.md +173 -173
  108. package/src/bmad-plus/packs/pack-shield/references/dpdpa/rights-and-obligations.md +426 -426
  109. package/src/bmad-plus/packs/pack-shield/references/dpdpa/rules-2025.md +599 -599
  110. package/src/bmad-plus/packs/pack-shield/references/dpdpa/sections-reference.md +319 -319
  111. package/src/bmad-plus/packs/pack-shield/references/ear/ccl-eccn-guide.md +250 -250
  112. package/src/bmad-plus/packs/pack-shield/references/ear/compliance-program.md +280 -280
  113. package/src/bmad-plus/packs/pack-shield/references/ear/license-exceptions.md +207 -207
  114. package/src/bmad-plus/packs/pack-shield/references/eu-ai-act/gpai-governance.md +267 -267
  115. package/src/bmad-plus/packs/pack-shield/references/eu-ai-act/obligations-high-risk.md +287 -287
  116. package/src/bmad-plus/packs/pack-shield/references/eu-ai-act/risk-classification.md +182 -182
  117. package/src/bmad-plus/packs/pack-shield/references/fedramp/appendices-guide.md +209 -209
  118. package/src/bmad-plus/packs/pack-shield/references/fedramp/control-families.md +281 -281
  119. package/src/bmad-plus/packs/pack-shield/references/fedramp/poam-guide.md +93 -93
  120. package/src/bmad-plus/packs/pack-shield/references/fedramp/readiness-checklist.md +134 -134
  121. package/src/bmad-plus/packs/pack-shield/references/fedramp/sap-sar-guide.md +86 -86
  122. package/src/bmad-plus/packs/pack-shield/references/fedramp/ssp-guide.md +129 -129
  123. package/src/bmad-plus/packs/pack-shield/references/gdpr-compliance/documents.md +192 -192
  124. package/src/bmad-plus/packs/pack-shield/references/gdpr-compliance/dpa-template.md +121 -121
  125. package/src/bmad-plus/packs/pack-shield/references/gdpr-compliance/privacy-notice.md +87 -87
  126. package/src/bmad-plus/packs/pack-shield/references/hipaa-compliance/breach-notification.md +293 -293
  127. package/src/bmad-plus/packs/pack-shield/references/hipaa-compliance/privacy-rule.md +276 -276
  128. package/src/bmad-plus/packs/pack-shield/references/hipaa-compliance/security-rule.md +299 -299
  129. package/src/bmad-plus/packs/pack-shield/references/hipaa-compliance/templates.md +568 -568
  130. package/src/bmad-plus/packs/pack-shield/references/ism/control-applicability.md +181 -181
  131. package/src/bmad-plus/packs/pack-shield/references/ism/guidelines-overview.md +183 -183
  132. package/src/bmad-plus/packs/pack-shield/references/iso27001/annex-a-2013.md +203 -203
  133. package/src/bmad-plus/packs/pack-shield/references/iso27001/annex-a-2022.md +132 -132
  134. package/src/bmad-plus/packs/pack-shield/references/iso27001/control-mapping.md +153 -153
  135. package/src/bmad-plus/packs/pack-shield/references/iso27701/annex-a-controls.md +195 -195
  136. package/src/bmad-plus/packs/pack-shield/references/iso27701/regulatory-mapping.md +229 -229
  137. package/src/bmad-plus/packs/pack-shield/references/iso27701/transition-guide.md +219 -219
  138. package/src/bmad-plus/packs/pack-shield/references/iso42001/iso42001-ai-risk-assessment.md +258 -258
  139. package/src/bmad-plus/packs/pack-shield/references/iso42001/iso42001-clauses-requirements.md +279 -279
  140. package/src/bmad-plus/packs/pack-shield/references/iso42001/iso42001-controls-annex-a.md +155 -155
  141. package/src/bmad-plus/packs/pack-shield/references/itar/compliance-program.md +174 -174
  142. package/src/bmad-plus/packs/pack-shield/references/itar/licensing-guide.md +146 -146
  143. package/src/bmad-plus/packs/pack-shield/references/itar/usml-categories.md +93 -93
  144. package/src/bmad-plus/packs/pack-shield/references/lgpd/anpd-enforcement.md +147 -147
  145. package/src/bmad-plus/packs/pack-shield/references/lgpd/compliance-program.md +272 -272
  146. package/src/bmad-plus/packs/pack-shield/references/lgpd/lgpd-articles.md +271 -271
  147. package/src/bmad-plus/packs/pack-shield/references/nis2/article-21-measures.md +153 -153
  148. package/src/bmad-plus/packs/pack-shield/references/nis2/iso27001-nis2-mapping.md +68 -68
  149. package/src/bmad-plus/packs/pack-shield/references/nist-800-53/assessment-rmf.md +349 -349
  150. package/src/bmad-plus/packs/pack-shield/references/nist-800-53/baselines-tailoring.md +277 -277
  151. package/src/bmad-plus/packs/pack-shield/references/nist-800-53/control-families.md +450 -450
  152. package/src/bmad-plus/packs/pack-shield/references/nist-ai-rmf/rmf-core.md +361 -361
  153. package/src/bmad-plus/packs/pack-shield/references/nist-ai-rmf/rmf-profiles.md +192 -192
  154. package/src/bmad-plus/packs/pack-shield/references/nist-csf/csf-10-to-20-mapping.md +143 -143
  155. package/src/bmad-plus/packs/pack-shield/references/nist-csf/csf-20-functions-categories.md +278 -278
  156. package/src/bmad-plus/packs/pack-shield/references/nist-csf/csf-implementation-tiers.md +135 -135
  157. package/src/bmad-plus/packs/pack-shield/references/pci-compliance/pci-dss-requirements.md +366 -366
  158. package/src/bmad-plus/packs/pack-shield/references/pci-compliance/pci-dss-saq-guide.md +217 -217
  159. package/src/bmad-plus/packs/pack-shield/references/pci-compliance/pci-dss-v4-changes.md +190 -190
  160. package/src/bmad-plus/packs/pack-shield/references/section-508/wcag-mapping.md +160 -160
  161. package/src/bmad-plus/packs/pack-shield/references/soc2/controls.md +241 -241
  162. package/src/bmad-plus/packs/pack-shield/references/soc2/evidence.md +236 -236
  163. package/src/bmad-plus/packs/pack-shield/references/soc2/policies.md +254 -254
  164. package/src/bmad-plus/packs/pack-shield/references/soc2/vendor.md +276 -276
  165. package/src/bmad-plus/packs/pack-shield/references/swift-csp/swift-assessment.md +202 -202
  166. package/src/bmad-plus/packs/pack-shield/references/swift-csp/swift-controls.md +545 -545
  167. package/src/bmad-plus/packs/pack-shield/references/tsa-compliance/tsa-crmp-requirements.md +359 -359
  168. package/src/bmad-plus/packs/pack-shield/references/tsa-compliance/tsa-directives-overview.md +187 -187
  169. package/src/bmad-plus/packs/pack-shield/references/tsa-compliance/tsa-incident-reporting.md +187 -187
  170. package/src/bmad-plus/packs/pack-shield/references/wcag/criteria-detail.md +510 -510
  171. package/src/bmad-plus/packs/pack-shield/shared/audit-report-template.md +103 -103
  172. package/src/bmad-plus/packs/pack-shield/shared/cross-framework-mapper.md +103 -103
  173. package/src/bmad-plus/packs/pack-shield/shared/gap-analysis-template.md +83 -83
  174. package/src/bmad-plus/packs/pack-shield/shield-orchestrator.md +229 -229
  175. package/src/bmad-plus/packs/pack-shield/upstream-sync.yaml +68 -68
  176. package/src/bmad-plus/skills/bmad-plus-autopilot/SKILL.md +99 -99
  177. package/src/bmad-plus/skills/bmad-plus-parallel/SKILL.md +93 -93
  178. package/src/bmad-plus/skills/bmad-plus-sync/SKILL.md +69 -69
  179. package/tools/bmad-plus-npx.js +3 -5
  180. package/tools/cli/bmad-plus-cli.js +5 -3
  181. package/tools/cli/commands/autoconfig.js +18 -61
  182. package/tools/cli/commands/doctor.js +30 -31
  183. package/tools/cli/commands/install.js +33 -343
  184. package/tools/cli/commands/memory.js +1 -0
  185. package/tools/cli/commands/scan.js +61 -74
  186. package/tools/cli/commands/uninstall.js +7 -4
  187. package/tools/cli/commands/update.js +15 -72
  188. package/tools/cli/i18n.js +92 -10
  189. package/tools/cli/lib/ide-config.js +259 -0
  190. package/tools/cli/lib/memory-init.js +113 -0
  191. package/tools/cli/lib/pack-copy.js +84 -0
  192. package/tools/cli/lib/packs.js +114 -0
  193. package/tools/cli/lib/stack-detect.js +102 -0
  194. package/tools/cli/lib/validate.js +45 -0
  195. package/src/bmad-plus/agents/pack-animated/animated-website-agent.md +0 -325
  196. package/src/bmad-plus/agents/pack-animated/templates/animated-website-workflow.md +0 -55
  197. package/src/bmad-plus/agents/pack-backup/backup-agent.md +0 -71
  198. package/src/bmad-plus/agents/pack-backup/templates/backup-workflow.md +0 -51
  199. package/src/bmad-plus/agents/pack-seo/SKILL.md +0 -171
  200. package/src/bmad-plus/agents/pack-seo/checklist.md +0 -140
  201. package/src/bmad-plus/agents/pack-seo/pagespeed-playbook.md +0 -320
  202. package/src/bmad-plus/agents/pack-seo/ref/audit-schema.json +0 -187
  203. package/src/bmad-plus/agents/pack-seo/ref/cwv-thresholds.md +0 -87
  204. package/src/bmad-plus/agents/pack-seo/ref/eeat-criteria.md +0 -123
  205. package/src/bmad-plus/agents/pack-seo/ref/geo-signals.md +0 -167
  206. package/src/bmad-plus/agents/pack-seo/ref/hreflang-rules.md +0 -153
  207. package/src/bmad-plus/agents/pack-seo/ref/quality-gates.md +0 -133
  208. package/src/bmad-plus/agents/pack-seo/ref/schema-catalog.md +0 -91
  209. package/src/bmad-plus/agents/pack-seo/ref/schema-templates.json +0 -356
  210. package/src/bmad-plus/agents/pack-seo/seo-chief.md +0 -294
  211. package/src/bmad-plus/agents/pack-seo/seo-judge.md +0 -241
  212. package/src/bmad-plus/agents/pack-seo/seo-scout.md +0 -171
  213. package/src/bmad-plus/agents/pack-seo/templates/seo-audit-workflow.md +0 -241
@@ -1,250 +1,250 @@
1
- # EAR Commerce Control List (CCL) and ECCN Classification Guide
2
-
3
- ## How to Use This Reference
4
-
5
- This guide covers: (1) detailed ECCN lookup methodology, (2) key ECCNs by category, (3) Commerce Country Chart usage, and (4) jurisdiction determination between EAR and ITAR.
6
-
7
- ---
8
-
9
- ## ECCN Classification Methodology
10
-
11
- ### Step 1: Determine if the Item is "Subject to the EAR" (§ 734.3)
12
-
13
- An item is subject to the EAR if it is:
14
- - All items **physically in the United States** (including in Foreign Trade Zones)
15
- - All items of **US origin** (manufactured in the US), regardless of location
16
- - **Foreign-made items** that incorporate controlled US-origin content above the de minimis threshold (§ 734.4) — 10% or 25% depending on destination
17
- - **Foreign direct products** of US technology/software that meet the FDPR criteria (§ 736.2(b)(3))
18
- - Items the president has placed under EAR jurisdiction by executive order
19
-
20
- **Not subject to EAR:** Publicly available information (§ 734.7), basic scientific research (fundamental research exclusion, § 734.8), patent applications, and items exclusively controlled by another US agency (ITAR/USML, NRC, FDA, etc.)
21
-
22
- ---
23
-
24
- ### Step 2: Apply the Order of Review (§ 732.3)
25
-
26
- | Step | Check | If Yes |
27
- |------|-------|--------|
28
- | 1 | Is the item on the USML (22 CFR Part 121)? | → ITAR jurisdiction; stop here |
29
- | 2 | Is it exclusively controlled by another US agency? | → That agency's regulations |
30
- | 3 | Is it subject to the EAR per § 734.3? | → Continue to CCL lookup |
31
- | 4 | Is it on the CCL? | → Assign ECCN |
32
- | 5 | Not on CCL | → EAR99 designation |
33
-
34
- ---
35
-
36
- ### Step 3: Search the CCL (Part 774, Supplement No. 1)
37
-
38
- Search strategies (in order of preference):
39
- 1. **Interactive CCL** at bis.gov/regulations/ear/interactive-commerce-control-list
40
- 2. **Self-classification:** Compare item's technical parameters (frequency, performance, materials) to CCL entry technical notes and parameters
41
- 3. **CCATS request:** Submit BIS-748P-A via SNAP-R for official classification determination
42
- 4. **CJ request to DDTC:** If jurisdiction between ITAR and EAR is unclear
43
-
44
- **Reading a CCL Entry:**
45
- Each ECCN entry contains:
46
- - **Entry heading:** ECCN number and title
47
- - **List of Items Controlled:** Specific technical parameters that determine if item falls under this ECCN
48
- - **Unit:** The unit of measure for reporting
49
- - **Reasons for Control (RFCs):** NS, AT, CB, NP, MT, etc.
50
- - **Country Chart columns:** Which RFC columns on the Country Chart to check
51
- - **License Exceptions:** Which exceptions (LVS, GBS, CIV, etc.) are available
52
- - **List of Items Controlled — Related Controls:** References to other ECCNs or USML categories
53
- - **Technical Notes:** Clarifications on measurement and interpretation
54
-
55
- ---
56
-
57
- ### Step 4: EAR99 — When to Use
58
-
59
- If after searching the CCL you cannot find an ECCN that covers the item:
60
- - The item is **EAR99**
61
- - EAR99 items **do not appear on the CCL** and have no ECCN number
62
- - They are subject to EAR jurisdiction but generally do not require a license for export
63
-
64
- **EAR99 items still require a license if:**
65
- - Destined for **embargoed countries** (Cuba, Iran, North Korea, Syria — Part 746)
66
- - Destined for **Russia or Belarus** under enhanced controls (Part 746.8)
67
- - The end-user is on the **Entity List** (Supplement 4, Part 744)
68
- - The end-use is for **WMD development** (§ 744.2–744.6)
69
- - Exporter has **knowledge** of prohibited end-use or end-user
70
-
71
- ---
72
-
73
- ## Key ECCNs by Category
74
-
75
- ### Category 0 — Nuclear Materials, Facilities, and Equipment
76
-
77
- | ECCN | Description |
78
- |------|-------------|
79
- | 0A001 | Nuclear reactors and specially designed equipment |
80
- | 0B001 | Nuclear test/measurement equipment |
81
- | 0C001 | "Natural uranium," "depleted uranium," special nuclear material |
82
- | 0D001 | Software for items controlled in Category 0 |
83
- | 0E001 | Technology for nuclear items |
84
-
85
- ### Category 1 — Chemicals, Microorganisms, and Toxins
86
-
87
- | ECCN | Description |
88
- |------|-------------|
89
- | 1C350 | Chemical weapons precursors (Schedule 2 and 3 chemicals) |
90
- | 1C351 | Human and zoonotic pathogens (Select Agents) |
91
- | 1C352 | Animal pathogens not in 1C351 |
92
- | 1C354 | Plant pathogens |
93
- | 1C810 | Ammonium nitrate (precursor concerns) |
94
-
95
- ### Category 3 — Electronics
96
-
97
- | ECCN | Description |
98
- |------|-------------|
99
- | 3A001 | Electronic components (advanced semiconductors, MMICs, SAW devices) |
100
- | 3A090 | Integrated circuits for advanced computing (high-bandwidth memory) |
101
- | 3B001 | Equipment for manufacturing electronic components (wafer fab) |
102
- | 3D001 | Software for Category 3 equipment |
103
- | 3E001 | Technology for Category 3 items |
104
-
105
- ### Category 4 — Computers
106
-
107
- | ECCN | Description |
108
- |------|-------------|
109
- | 4A003 | Electronic computers and related equipment (performance thresholds) |
110
- | 4A090 | Computers/electronic assemblies for advanced computing (AI chips) |
111
- | 4D001 | Software for high-performance computers |
112
- | 4E001 | Technology for Category 4 items |
113
-
114
- ### Category 5 — Telecommunications and Information Security
115
-
116
- | ECCN | Description |
117
- |------|-------------|
118
- | 5A002 | Telecommunications systems (secure comms equipment) |
119
- | 5B002 | Telecom test equipment |
120
- | 5D002 | Software for telecommunications/encryption |
121
- | 5E002 | Technology for encryption and telecom |
122
- | 5A992 | Telecommunications not controlled by 5A002 (lower performance) |
123
- | 5D992 | Mass-market software for telecom |
124
-
125
- ### Category 7 — Navigation and Avionics
126
-
127
- | ECCN | Description |
128
- |------|-------------|
129
- | 7A001 | Accelerometers with specific performance |
130
- | 7A004 | Star trackers and attitude control equipment |
131
- | 7A101 | Gyroscopes and accelerometers for missiles |
132
- | 7E001 | Technology for navigation items |
133
-
134
- ### Category 9 — Aerospace and Propulsion
135
-
136
- | ECCN | Description |
137
- |------|-------------|
138
- | 9A001 | Aerojet engines and components |
139
- | 9A004 | Space launch vehicles and spacecraft |
140
- | 9A515 | Spacecraft and related items (satellites) |
141
- | 9E003 | Technology for turbofan and turboprop engines |
142
-
143
- ---
144
-
145
- ## Commerce Country Chart — How to Use (Part 738, Supplement 1)
146
-
147
- ### Purpose
148
- The Country Chart determines if a license is required based on the combination of the item's **Reason(s) for Control** and the **destination country**.
149
-
150
- ### Reading the Chart
151
- 1. Find the destination country (rows, alphabetical)
152
- 2. Find the RFC column(s) for your item's ECCNs (e.g., NS Column 1, AT Column 1, CB Column 1)
153
- 3. If the cell shows an "**X**" → a license is generally required
154
- 4. If blank → generally no license required for that RFC/country combination
155
-
156
- ### Important: Multiple RFCs
157
- If your ECCN has multiple RFCs (e.g., NS and AT), check **all applicable columns** for the destination. A license is required if any RFC/country cell shows "X" **unless** a license exception applies for that specific RFC.
158
-
159
- ### Country Chart Column Codes
160
-
161
- | Column | Meaning |
162
- |--------|---------|
163
- | NS Column 1 | National security — sensitive items |
164
- | NS Column 2 | National security — less sensitive items |
165
- | MT Column 1 | Missile technology |
166
- | NP Column 1 | Nuclear nonproliferation — major suppliers group |
167
- | NP Column 2 | Nuclear nonproliferation — trigger list |
168
- | CB Column 1 | Chemical and biological — Australia Group |
169
- | CB Column 2 | Chemical and biological — non-Australia Group |
170
- | RS Column 1 | Regional stability — most items |
171
- | RS Column 2 | Regional stability — less sensitive |
172
- | CC Column 1 | Crime control — all items |
173
- | CC Column 2 | Crime control — shotguns |
174
- | CC Column 3 | Crime control — used equipment |
175
- | AT Column 1 | Anti-terrorism — all items |
176
- | AT Column 2 | Anti-terrorism — shotguns |
177
- | UN | UN embargo |
178
-
179
- ---
180
-
181
- ## Jurisdiction Determination: EAR vs. ITAR
182
-
183
- ### The "Order of Review" in Detail
184
-
185
- The US government mandates exporters apply this order before determining export classification:
186
-
187
- **STEP 1 — Consult the USML (22 CFR Part 121):**
188
- - The USML has 21 categories (Cat. I–XXI) covering military articles
189
- - If the item is "specially designed" or enumerated on the USML → ITAR jurisdiction, file with DDTC
190
- - The "specially designed" standard is complex — items designed for civilian use that are identical to military articles may still be EAR
191
-
192
- **STEP 2 — Consult the CCL:**
193
- - If not on USML → check CCL
194
- - If found on CCL → assign ECCN
195
- - If not found → EAR99
196
-
197
- **When jurisdiction is unclear — Submit a CJ Request:**
198
- - **CJ (Commodity Jurisdiction) Request** — submitted to DDTC
199
- - Used when: an item has both military and commercial versions; an item was transferred from USML to CCL under Export Control Reform; or there's genuine ambiguity
200
- - Timeline: 45-day statutory deadline; in practice, can take longer
201
- - **CCATS** — BIS's equivalent for confirming an ECCN (use SNAP-R portal)
202
-
203
- ### Common EAR/ITAR Boundary Areas
204
-
205
- | Item Type | Likely Jurisdiction |
206
- |-----------|-------------------|
207
- | Consumer electronics, mass-market software | EAR (usually EAR99 or 5D992) |
208
- | Dual-use encryption (commercial VPN, SSL) | EAR (5D002 or 5D992 ENC) |
209
- | Military radios, tactical communications | ITAR (Cat. XI) |
210
- | Satellite components (commercial comms sats) | EAR (9A515) after Export Control Reform |
211
- | Satellite components (military reconnaissance) | ITAR (Cat. XV) |
212
- | Firearms and ammunition | ITAR (Cat. I and III); some EAR (shotguns) |
213
- | Chemical precursors (dual-use) | EAR (Category 1) |
214
- | Chemical weapons agents | ITAR (Cat. XIV) |
215
- | Aircraft parts (commercial) | EAR (Category 9, lower threshold) |
216
- | Military aircraft engines | ITAR (Cat. VIII) |
217
- | GPS (commercial grade) | EAR (7A994, EAR99) |
218
- | GPS (military, high-performance) | ITAR (Cat. XV) |
219
- | Cybersecurity tools (commercial pen-testing) | EAR (5D002, ENC exception may apply) |
220
- | Cyberweapons and offensive capabilities | Likely ITAR or unilateral controls |
221
-
222
- ---
223
-
224
- ## EAR99 Items That Still Need Licenses — Common Mistakes
225
-
226
- | Scenario | Why License Needed |
227
- |----------|--------------------|
228
- | EAR99 electronics exported to Iran | Part 746 embargo — license required |
229
- | EAR99 software sold to Entity List party | Entity List requirement — license required |
230
- | EAR99 pump sold for nuclear programme | WMD end-use control § 744.2 |
231
- | EAR99 laptop reexported from Germany to Russia | Part 746.8 Russia controls apply to all items |
232
- | EAR99 goods with 10%+ US content to D:5 country | De minimis rule — license may be required |
233
- | EAR99 circuit board demonstrated to Iranian engineer in US | Deemed export to Iran — check § 734.13 |
234
-
235
- ---
236
-
237
- ## EAR Controls on Russia and China — Key 2022–2026 Developments
238
-
239
- ### Russia and Belarus (Part 746.8)
240
- Following February 2022, BIS imposed broad new controls:
241
- - **All items subject to EAR** require a license for export to Russia/Belarus (including EAR99)
242
- - Extremely limited license exceptions available (humanitarian, safety of flight)
243
- - Entity List additions: hundreds of Russian defence and intelligence entities
244
- - **FDP Rule for Russia:** Expanded FDPR captures foreign-made items produced by US equipment/software used to fabricate circuits destined for Russia's military
245
-
246
- ### China Advanced Computing Controls (October 2022 / October 2023)
247
- - New ECCNs 3A090, 4A090 control advanced AI chips above performance thresholds
248
- - Entity List expanded with semiconductor-related entities (Huawei, affiliates, others)
249
- - FDPR expanded to capture foreign-made chips using US equipment if destined for restricted Chinese entities
250
- - "ITAR Carve-Out" items — some satellite/military items moved from ITAR to EAR under Export Control Reform but with strict CCL controls
1
+ # EAR Commerce Control List (CCL) and ECCN Classification Guide
2
+
3
+ ## How to Use This Reference
4
+
5
+ This guide covers: (1) detailed ECCN lookup methodology, (2) key ECCNs by category, (3) Commerce Country Chart usage, and (4) jurisdiction determination between EAR and ITAR.
6
+
7
+ ---
8
+
9
+ ## ECCN Classification Methodology
10
+
11
+ ### Step 1: Determine if the Item is "Subject to the EAR" (§ 734.3)
12
+
13
+ An item is subject to the EAR if it is:
14
+ - All items **physically in the United States** (including in Foreign Trade Zones)
15
+ - All items of **US origin** (manufactured in the US), regardless of location
16
+ - **Foreign-made items** that incorporate controlled US-origin content above the de minimis threshold (§ 734.4) — 10% or 25% depending on destination
17
+ - **Foreign direct products** of US technology/software that meet the FDPR criteria (§ 736.2(b)(3))
18
+ - Items the president has placed under EAR jurisdiction by executive order
19
+
20
+ **Not subject to EAR:** Publicly available information (§ 734.7), basic scientific research (fundamental research exclusion, § 734.8), patent applications, and items exclusively controlled by another US agency (ITAR/USML, NRC, FDA, etc.)
21
+
22
+ ---
23
+
24
+ ### Step 2: Apply the Order of Review (§ 732.3)
25
+
26
+ | Step | Check | If Yes |
27
+ |------|-------|--------|
28
+ | 1 | Is the item on the USML (22 CFR Part 121)? | → ITAR jurisdiction; stop here |
29
+ | 2 | Is it exclusively controlled by another US agency? | → That agency's regulations |
30
+ | 3 | Is it subject to the EAR per § 734.3? | → Continue to CCL lookup |
31
+ | 4 | Is it on the CCL? | → Assign ECCN |
32
+ | 5 | Not on CCL | → EAR99 designation |
33
+
34
+ ---
35
+
36
+ ### Step 3: Search the CCL (Part 774, Supplement No. 1)
37
+
38
+ Search strategies (in order of preference):
39
+ 1. **Interactive CCL** at bis.gov/regulations/ear/interactive-commerce-control-list
40
+ 2. **Self-classification:** Compare item's technical parameters (frequency, performance, materials) to CCL entry technical notes and parameters
41
+ 3. **CCATS request:** Submit BIS-748P-A via SNAP-R for official classification determination
42
+ 4. **CJ request to DDTC:** If jurisdiction between ITAR and EAR is unclear
43
+
44
+ **Reading a CCL Entry:**
45
+ Each ECCN entry contains:
46
+ - **Entry heading:** ECCN number and title
47
+ - **List of Items Controlled:** Specific technical parameters that determine if item falls under this ECCN
48
+ - **Unit:** The unit of measure for reporting
49
+ - **Reasons for Control (RFCs):** NS, AT, CB, NP, MT, etc.
50
+ - **Country Chart columns:** Which RFC columns on the Country Chart to check
51
+ - **License Exceptions:** Which exceptions (LVS, GBS, CIV, etc.) are available
52
+ - **List of Items Controlled — Related Controls:** References to other ECCNs or USML categories
53
+ - **Technical Notes:** Clarifications on measurement and interpretation
54
+
55
+ ---
56
+
57
+ ### Step 4: EAR99 — When to Use
58
+
59
+ If after searching the CCL you cannot find an ECCN that covers the item:
60
+ - The item is **EAR99**
61
+ - EAR99 items **do not appear on the CCL** and have no ECCN number
62
+ - They are subject to EAR jurisdiction but generally do not require a license for export
63
+
64
+ **EAR99 items still require a license if:**
65
+ - Destined for **embargoed countries** (Cuba, Iran, North Korea, Syria — Part 746)
66
+ - Destined for **Russia or Belarus** under enhanced controls (Part 746.8)
67
+ - The end-user is on the **Entity List** (Supplement 4, Part 744)
68
+ - The end-use is for **WMD development** (§ 744.2–744.6)
69
+ - Exporter has **knowledge** of prohibited end-use or end-user
70
+
71
+ ---
72
+
73
+ ## Key ECCNs by Category
74
+
75
+ ### Category 0 — Nuclear Materials, Facilities, and Equipment
76
+
77
+ | ECCN | Description |
78
+ |------|-------------|
79
+ | 0A001 | Nuclear reactors and specially designed equipment |
80
+ | 0B001 | Nuclear test/measurement equipment |
81
+ | 0C001 | "Natural uranium," "depleted uranium," special nuclear material |
82
+ | 0D001 | Software for items controlled in Category 0 |
83
+ | 0E001 | Technology for nuclear items |
84
+
85
+ ### Category 1 — Chemicals, Microorganisms, and Toxins
86
+
87
+ | ECCN | Description |
88
+ |------|-------------|
89
+ | 1C350 | Chemical weapons precursors (Schedule 2 and 3 chemicals) |
90
+ | 1C351 | Human and zoonotic pathogens (Select Agents) |
91
+ | 1C352 | Animal pathogens not in 1C351 |
92
+ | 1C354 | Plant pathogens |
93
+ | 1C810 | Ammonium nitrate (precursor concerns) |
94
+
95
+ ### Category 3 — Electronics
96
+
97
+ | ECCN | Description |
98
+ |------|-------------|
99
+ | 3A001 | Electronic components (advanced semiconductors, MMICs, SAW devices) |
100
+ | 3A090 | Integrated circuits for advanced computing (high-bandwidth memory) |
101
+ | 3B001 | Equipment for manufacturing electronic components (wafer fab) |
102
+ | 3D001 | Software for Category 3 equipment |
103
+ | 3E001 | Technology for Category 3 items |
104
+
105
+ ### Category 4 — Computers
106
+
107
+ | ECCN | Description |
108
+ |------|-------------|
109
+ | 4A003 | Electronic computers and related equipment (performance thresholds) |
110
+ | 4A090 | Computers/electronic assemblies for advanced computing (AI chips) |
111
+ | 4D001 | Software for high-performance computers |
112
+ | 4E001 | Technology for Category 4 items |
113
+
114
+ ### Category 5 — Telecommunications and Information Security
115
+
116
+ | ECCN | Description |
117
+ |------|-------------|
118
+ | 5A002 | Telecommunications systems (secure comms equipment) |
119
+ | 5B002 | Telecom test equipment |
120
+ | 5D002 | Software for telecommunications/encryption |
121
+ | 5E002 | Technology for encryption and telecom |
122
+ | 5A992 | Telecommunications not controlled by 5A002 (lower performance) |
123
+ | 5D992 | Mass-market software for telecom |
124
+
125
+ ### Category 7 — Navigation and Avionics
126
+
127
+ | ECCN | Description |
128
+ |------|-------------|
129
+ | 7A001 | Accelerometers with specific performance |
130
+ | 7A004 | Star trackers and attitude control equipment |
131
+ | 7A101 | Gyroscopes and accelerometers for missiles |
132
+ | 7E001 | Technology for navigation items |
133
+
134
+ ### Category 9 — Aerospace and Propulsion
135
+
136
+ | ECCN | Description |
137
+ |------|-------------|
138
+ | 9A001 | Aerojet engines and components |
139
+ | 9A004 | Space launch vehicles and spacecraft |
140
+ | 9A515 | Spacecraft and related items (satellites) |
141
+ | 9E003 | Technology for turbofan and turboprop engines |
142
+
143
+ ---
144
+
145
+ ## Commerce Country Chart — How to Use (Part 738, Supplement 1)
146
+
147
+ ### Purpose
148
+ The Country Chart determines if a license is required based on the combination of the item's **Reason(s) for Control** and the **destination country**.
149
+
150
+ ### Reading the Chart
151
+ 1. Find the destination country (rows, alphabetical)
152
+ 2. Find the RFC column(s) for your item's ECCNs (e.g., NS Column 1, AT Column 1, CB Column 1)
153
+ 3. If the cell shows an "**X**" → a license is generally required
154
+ 4. If blank → generally no license required for that RFC/country combination
155
+
156
+ ### Important: Multiple RFCs
157
+ If your ECCN has multiple RFCs (e.g., NS and AT), check **all applicable columns** for the destination. A license is required if any RFC/country cell shows "X" **unless** a license exception applies for that specific RFC.
158
+
159
+ ### Country Chart Column Codes
160
+
161
+ | Column | Meaning |
162
+ |--------|---------|
163
+ | NS Column 1 | National security — sensitive items |
164
+ | NS Column 2 | National security — less sensitive items |
165
+ | MT Column 1 | Missile technology |
166
+ | NP Column 1 | Nuclear nonproliferation — major suppliers group |
167
+ | NP Column 2 | Nuclear nonproliferation — trigger list |
168
+ | CB Column 1 | Chemical and biological — Australia Group |
169
+ | CB Column 2 | Chemical and biological — non-Australia Group |
170
+ | RS Column 1 | Regional stability — most items |
171
+ | RS Column 2 | Regional stability — less sensitive |
172
+ | CC Column 1 | Crime control — all items |
173
+ | CC Column 2 | Crime control — shotguns |
174
+ | CC Column 3 | Crime control — used equipment |
175
+ | AT Column 1 | Anti-terrorism — all items |
176
+ | AT Column 2 | Anti-terrorism — shotguns |
177
+ | UN | UN embargo |
178
+
179
+ ---
180
+
181
+ ## Jurisdiction Determination: EAR vs. ITAR
182
+
183
+ ### The "Order of Review" in Detail
184
+
185
+ The US government mandates exporters apply this order before determining export classification:
186
+
187
+ **STEP 1 — Consult the USML (22 CFR Part 121):**
188
+ - The USML has 21 categories (Cat. I–XXI) covering military articles
189
+ - If the item is "specially designed" or enumerated on the USML → ITAR jurisdiction, file with DDTC
190
+ - The "specially designed" standard is complex — items designed for civilian use that are identical to military articles may still be EAR
191
+
192
+ **STEP 2 — Consult the CCL:**
193
+ - If not on USML → check CCL
194
+ - If found on CCL → assign ECCN
195
+ - If not found → EAR99
196
+
197
+ **When jurisdiction is unclear — Submit a CJ Request:**
198
+ - **CJ (Commodity Jurisdiction) Request** — submitted to DDTC
199
+ - Used when: an item has both military and commercial versions; an item was transferred from USML to CCL under Export Control Reform; or there's genuine ambiguity
200
+ - Timeline: 45-day statutory deadline; in practice, can take longer
201
+ - **CCATS** — BIS's equivalent for confirming an ECCN (use SNAP-R portal)
202
+
203
+ ### Common EAR/ITAR Boundary Areas
204
+
205
+ | Item Type | Likely Jurisdiction |
206
+ |-----------|-------------------|
207
+ | Consumer electronics, mass-market software | EAR (usually EAR99 or 5D992) |
208
+ | Dual-use encryption (commercial VPN, SSL) | EAR (5D002 or 5D992 ENC) |
209
+ | Military radios, tactical communications | ITAR (Cat. XI) |
210
+ | Satellite components (commercial comms sats) | EAR (9A515) after Export Control Reform |
211
+ | Satellite components (military reconnaissance) | ITAR (Cat. XV) |
212
+ | Firearms and ammunition | ITAR (Cat. I and III); some EAR (shotguns) |
213
+ | Chemical precursors (dual-use) | EAR (Category 1) |
214
+ | Chemical weapons agents | ITAR (Cat. XIV) |
215
+ | Aircraft parts (commercial) | EAR (Category 9, lower threshold) |
216
+ | Military aircraft engines | ITAR (Cat. VIII) |
217
+ | GPS (commercial grade) | EAR (7A994, EAR99) |
218
+ | GPS (military, high-performance) | ITAR (Cat. XV) |
219
+ | Cybersecurity tools (commercial pen-testing) | EAR (5D002, ENC exception may apply) |
220
+ | Cyberweapons and offensive capabilities | Likely ITAR or unilateral controls |
221
+
222
+ ---
223
+
224
+ ## EAR99 Items That Still Need Licenses — Common Mistakes
225
+
226
+ | Scenario | Why License Needed |
227
+ |----------|--------------------|
228
+ | EAR99 electronics exported to Iran | Part 746 embargo — license required |
229
+ | EAR99 software sold to Entity List party | Entity List requirement — license required |
230
+ | EAR99 pump sold for nuclear programme | WMD end-use control § 744.2 |
231
+ | EAR99 laptop reexported from Germany to Russia | Part 746.8 Russia controls apply to all items |
232
+ | EAR99 goods with 10%+ US content to D:5 country | De minimis rule — license may be required |
233
+ | EAR99 circuit board demonstrated to Iranian engineer in US | Deemed export to Iran — check § 734.13 |
234
+
235
+ ---
236
+
237
+ ## EAR Controls on Russia and China — Key 2022–2026 Developments
238
+
239
+ ### Russia and Belarus (Part 746.8)
240
+ Following February 2022, BIS imposed broad new controls:
241
+ - **All items subject to EAR** require a license for export to Russia/Belarus (including EAR99)
242
+ - Extremely limited license exceptions available (humanitarian, safety of flight)
243
+ - Entity List additions: hundreds of Russian defence and intelligence entities
244
+ - **FDP Rule for Russia:** Expanded FDPR captures foreign-made items produced by US equipment/software used to fabricate circuits destined for Russia's military
245
+
246
+ ### China Advanced Computing Controls (October 2022 / October 2023)
247
+ - New ECCNs 3A090, 4A090 control advanced AI chips above performance thresholds
248
+ - Entity List expanded with semiconductor-related entities (Huawei, affiliates, others)
249
+ - FDPR expanded to capture foreign-made chips using US equipment if destined for restricted Chinese entities
250
+ - "ITAR Carve-Out" items — some satellite/military items moved from ITAR to EAR under Export Control Reform but with strict CCL controls