# Technology Control Plan Template > Source: https://netray.co/tools/technology-control-plan-template > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A fill-in technology control plan covering facility access, foreign person controls, IT safeguards, training and recordkeeping for controlled technical data. ## Category compliance-legal ## Industry Defense Contracting ## Region United States ## Audience - Export compliance officer - Facility security officer - Operations manager ## Tool **Kind:** template **Output:** document **Fields:** #### Company name **Key:** company **Type:** text **Default:** Harbor Precision Systems Inc. #### Facility / site **Key:** site **Type:** text **Default:** Plant 2, Huntsville, Alabama #### Plan owner **Key:** owner **Type:** text **Default:** Empowered Official / Export Compliance Manager #### Effective date **Key:** effective **Type:** date **Default:** 2026-11-01 #### Controlled technology covered **Key:** data **Type:** textarea **Default:** ITAR technical data for the SIGMA-4 radar housing program (USML Category XI), and EAR controlled production technology for related machined assemblies. #### Controlled areas **Key:** areas **Type:** textarea **Default:** Engineering Lab B, Machining Cell 3 and Document Control Room, badge-restricted with visitor log. #### IT systems holding controlled data **Key:** systems **Type:** textarea **Default:** PLM vault (US-hosted), ERP document attachments restricted by role, and an isolated engineering file share. #### Foreign person policy **Key:** foreign **Type:** select **Options:** - No foreign person access without prior authorisation - Access only under an approved licence or agreement - Case-by-case review by compliance **Default:** No foreign person access without prior authorisation #### Training frequency **Key:** training **Type:** select **Options:** - At hire and annually - At hire and every two years - At hire only **Default:** At hire and annually #### Record retention (years) **Key:** retention **Type:** number **Default:** 5 **Blocks:** #### Technology Control Plan **Body:** Company: {{company}} Site: {{site}} Plan owner: {{owner}} Effective date: {{effective}} #### 1. Purpose and scope **Body:** This plan describes how {{company}} protects export controlled technology from unauthorised access, release or transfer, including deemed exports to foreign persons. It applies to all employees, contractors, visitors and subcontractors with access to the technology listed below. Controlled technology covered: {{data}} #### 2. Physical security **Body:** Controlled areas: {{areas}} Access to these areas is limited to authorised personnel. Visitors must sign in, be escorted and are not permitted to view controlled drawings, displays or hardware without written approval from the plan owner. #### 3. Information security **Body:** Systems holding controlled data: {{systems}} Access is granted by role, reviewed on a set schedule, and removed on role change or separation. Controlled data may not be sent by personal email, consumer messaging or unapproved cloud storage. Remote access requires approved devices and encrypted connections. #### 4. Foreign person access **Body:** Policy: {{foreign}}. HR and the plan owner screen new hires, interns and contractors for citizenship or permanent resident status before granting access. Any proposed access by a foreign person is referred to the plan owner before access is provisioned. #### 5. Training and acknowledgement **Body:** Personnel with access receive training: {{training}}. Each person signs an acknowledgement of their responsibilities and the penalties for unauthorised disclosure. #### 6. Marking, transmission and disposal **Body:** Controlled documents carry export control markings. Transmission to third parties requires an approved agreement or authorisation on file. Controlled media is returned or destroyed by approved methods and the action is recorded. #### 7. Recordkeeping and audit **Body:** Records of access approvals, training, visitor logs, shipments and incident reports are retained for {{retention}} years. The plan owner reviews this plan at least annually and after any incident, reorganisation or change in program scope. #### Document roles **Table:** **Columns:** - Role - Responsibility - Name **Rows:** **0:** Plan owner **1:** Maintains plan, approves access exceptions **2:** {{owner}} **0:** HR **1:** Pre-access screening and offboarding **0:** IT security **1:** Role-based access and logging **0:** Program manager **1:** Identifies controlled technology #### Approvals **Signatures:** - Plan owner - Facility manager - Senior executive **Notes:** This is a starting point, not legal advice. A technology control plan should be tailored to your products, licences and facilities and reviewed by qualified export counsel. Do not rely on it as a substitute for an authorisation where one is required. ## Content **Intro:** A technology control plan, or TCP, documents how a company keeps ITAR and EAR controlled technical data from reaching unauthorised people, including foreign person employees and visitors. Auditors, primes and licensing officers often ask to see one. **Sections:** #### How to use the template **Body:** Fill in the fields on the left and the document updates immediately. Start by naming the controlled technology precisely, because everything else in the plan depends on it: which programs, which USML categories or ECCNs, and which drawings, models and software. Then list the physical areas and IT systems where that technology lives. Export the result to Word or PDF, have counsel review it, and circulate it for signature. #### What a good TCP covers **Body:** Regulators do not prescribe a single format, but practical plans share the same building blocks. They define scope, secure facilities, restrict systems, handle foreign person access, train staff, control marking and transmission, and keep records. Each block should point to a named owner and a way to evidence compliance, such as badge logs, access reviews and signed acknowledgements. **Bullets:** - Scope and technology definition - Physical and information security - Foreign person screening and deemed export rules - Training, marking, transmission and disposal - Records, audit and plan review #### Deemed exports and foreign persons **Body:** Releasing controlled technology or technical data to a foreign person in the United States can be treated as an export to that person's country of nationality. That is why the TCP needs a gate before account provisioning, not just a policy statement. Connect HR onboarding, badge issuance and ERP or PLM role assignment so a new hire cannot see controlled files until compliance has cleared them. #### Common mistakes **Body:** Plans fail when they are generic, when nobody owns them, or when IT permissions drift away from the document. Others describe controls the site does not actually operate. Keep the plan short enough to follow, tie each commitment to evidence you can produce, and review it whenever a program, facility or system changes. **Cta:** If you want TCP rules enforced in your PLM and ERP roles rather than only on paper, Netray can help design private, on-prem access checks and reporting. **Faq:** #### Is a technology control plan required by law? **Answer:** The ITAR and EAR do not mandate one by name, but it is a widely used way to show reasonable controls, especially when foreign persons work at a facility. Licences, agreements, contracts or primes may require one as a condition. #### Who should own the TCP? **Answer:** Usually the empowered official or export compliance manager, with support from HR, IT security and facilities. A single named owner who can approve exceptions and who reviews the plan on a schedule keeps it from going stale. #### Does the TCP cover visitors? **Answer:** Yes. Visitor sign-in, escort rules and restrictions on viewing controlled drawings, screens or hardware should be part of the plan, along with a rule for foreign national visitors that routes through compliance first. #### How often should the plan be reviewed? **Answer:** At least annually, and after any change to programs, facilities, IT systems, ownership or applicable regulations. Record each review with a date and reviewer so you can show it was kept current. ## Search terms technology control plan template, tcp template itar, technology control plan sample, foreign national access plan, deemed export control plan, itar technical data access plan, export compliance tcp word, technology control plan example --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json