Technology Control Plan Template
A technology control plan, or TCP, documents how a company keeps ITAR and EAR controlled technical data from reaching unauthorised people, including foreign person employees and visitors. Auditors, primes and licensing officers often ask to see one.
Fill in
Technology Control Plan (TCP) Template
Technology Control Plan
Company: Harbor Precision Systems Inc. Site: Plant 2, Huntsville, Alabama Plan owner: Empowered Official / Export Compliance Manager Effective date: 2026-11-01
1. Purpose and scope
This plan describes how Harbor Precision Systems Inc. protects export controlled technology from unauthorised access, release or transfer, including deemed exports to foreign persons. It applies to all employees, contractors, visitors and subcontractors with access to the technology listed below.
Controlled technology covered: ITAR technical data for the SIGMA-4 radar housing program (USML Category XI), and EAR controlled production technology for related machined assemblies.
2. Physical security
Controlled areas: Engineering Lab B, Machining Cell 3 and Document Control Room, badge-restricted with visitor log.
Access to these areas is limited to authorised personnel. Visitors must sign in, be escorted and are not permitted to view controlled drawings, displays or hardware without written approval from the plan owner.
3. Information security
Systems holding controlled data: PLM vault (US-hosted), ERP document attachments restricted by role, and an isolated engineering file share.
Access is granted by role, reviewed on a set schedule, and removed on role change or separation. Controlled data may not be sent by personal email, consumer messaging or unapproved cloud storage. Remote access requires approved devices and encrypted connections.
4. Foreign person access
Policy: No foreign person access without prior authorisation.
HR and the plan owner screen new hires, interns and contractors for citizenship or permanent resident status before granting access. Any proposed access by a foreign person is referred to the plan owner before access is provisioned.
5. Training and acknowledgement
Personnel with access receive training: At hire and annually. Each person signs an acknowledgement of their responsibilities and the penalties for unauthorised disclosure.
6. Marking, transmission and disposal
Controlled documents carry export control markings. Transmission to third parties requires an approved agreement or authorisation on file. Controlled media is returned or destroyed by approved methods and the action is recorded.
7. Recordkeeping and audit
Records of access approvals, training, visitor logs, shipments and incident reports are retained for 5 years. The plan owner reviews this plan at least annually and after any incident, reorganisation or change in program scope.
Document roles
| Role | Responsibility | Name |
|---|---|---|
| Plan owner | Maintains plan, approves access exceptions | Empowered Official / Export Compliance Manager |
| HR | Pre-access screening and offboarding | |
| IT security | Role-based access and logging | |
| Program manager | Identifies controlled technology |
Approvals
This is a starting point, not legal advice. A technology control plan should be tailored to your products, licences and facilities and reviewed by qualified export counsel. Do not rely on it as a substitute for an authorisation where one is required.
Turn your TCP into enforced access rules
We can map plan controls to ERP and PLM roles and reporting inside your own environment.
Optional. The tool and every export work without this. No spam.
How to use the template
Fill in the fields on the left and the document updates immediately. Start by naming the controlled technology precisely, because everything else in the plan depends on it: which programs, which USML categories or ECCNs, and which drawings, models and software. Then list the physical areas and IT systems where that technology lives. Export the result to Word or PDF, have counsel review it, and circulate it for signature.
What a good TCP covers
Regulators do not prescribe a single format, but practical plans share the same building blocks. They define scope, secure facilities, restrict systems, handle foreign person access, train staff, control marking and transmission, and keep records. Each block should point to a named owner and a way to evidence compliance, such as badge logs, access reviews and signed acknowledgements.
- Scope and technology definition
- Physical and information security
- Foreign person screening and deemed export rules
- Training, marking, transmission and disposal
- Records, audit and plan review
Deemed exports and foreign persons
Releasing controlled technology or technical data to a foreign person in the United States can be treated as an export to that person's country of nationality. That is why the TCP needs a gate before account provisioning, not just a policy statement. Connect HR onboarding, badge issuance and ERP or PLM role assignment so a new hire cannot see controlled files until compliance has cleared them.
Common mistakes
Plans fail when they are generic, when nobody owns them, or when IT permissions drift away from the document. Others describe controls the site does not actually operate. Keep the plan short enough to follow, tie each commitment to evidence you can produce, and review it whenever a program, facility or system changes.
Frequently Asked Questions
Is a technology control plan required by law?
The ITAR and EAR do not mandate one by name, but it is a widely used way to show reasonable controls, especially when foreign persons work at a facility. Licences, agreements, contracts or primes may require one as a condition.
Who should own the TCP?
Usually the empowered official or export compliance manager, with support from HR, IT security and facilities. A single named owner who can approve exceptions and who reviews the plan on a schedule keeps it from going stale.
Does the TCP cover visitors?
Yes. Visitor sign-in, escort rules and restrictions on viewing controlled drawings, screens or hardware should be part of the plan, along with a rule for foreign national visitors that routes through compliance first.
How often should the plan be reviewed?
At least annually, and after any change to programs, facilities, IT systems, ownership or applicable regulations. Record each review with a date and reviewer so you can show it was kept current.
If you want TCP rules enforced in your PLM and ERP roles rather than only on paper, Netray can help design private, on-prem access checks and reporting.
Related Tools
EAR ECCN Self-Classification Worksheet
An editable worksheet to document how each part or technology was classified under the EAR: USML check, CCL category, ECCN, reasons for control and the evidence you relied on.
Aerospace & DefenseCUI Marking Checklist for DoD Contractors
A practical checklist for marking, handling, storing, transmitting and destroying controlled unclassified information in contractor environments.
Compliance & ContractsITAR USML Categories Reference Table
A searchable list of the 21 USML categories, I through XXI, with a plain-language note on what each tends to cover and how to flag it in your ERP.
Compliance & ContractsExport License Tracking Worksheet
An editable log of export licences and agreements showing authorised value, value shipped, remaining balance, percent used and expiry date.
Aerospace & DefenseITAR Compliance Checklist for Manufacturers
A 32-point checklist covering DDTC registration, technical data controls, foreign person access, IT security, and recordkeeping for ITAR-regulated manufacturers.
More Compliance & Contracts tools
See all- DFARS 252.204-7012 Cyber Incident Report Template
- NIST SP 800-171 System Security Plan (SSP) Template
- CMMC POA&M (Plan of Action and Milestones) Worksheet
- DFARS 252.204-7012 Cyber Incident Report Template
- Foreign Person Visitor Access Request Template
- ITAR Technical Data Transfer Log Worksheet
- Export Classification Matrix Worksheet (USML and ECCN)
- End-Use and End-User Statement Template
- Defense Subcontractor Flow-Down Tracker Worksheet