University of Pittsburgh logo

Acknowledgements & Technology Control Plans (TCPS)

A. Development 

If the UECO determines a certain item, technology, visit or specific project is export controlled, the UECO and export control staff will work with the PI to develop and implement a Technology Control Plan (TCP) to secure the controlled technology from access by unlicensed non-U.S. citizens. The UECO may instead issue a streamlined or simplified TCP, known as an Acknowledgement Form, depending on the nature of the applicable controls. The Acknowledgement Form will be sent to the PI and list the controlled nature of the piece and other guidance so that the PI and his/her staff do not violate any export controls regulations. If a full TCP is necessary, it will include the following sections:

  1. a commitment to export controls compliance;
     
  2. identification of the relevant export control categories and controlled technologies;
     
  3. identification of the project’s sponsors;
     
  4. identification and nationality of each individual participating in the project;
     
  5. appropriate physical and informational security measures;
     
  6. personnel screening measures; and
     
  7. appropriate security measures for and following project termination.

B. Appropriate Security Measures 

The TCP will include physical and informational security measures appropriate to the export controls categories involved in the project. Examples of security measures include, but are not limited to:

  • Laboratory Compartmentalization. Project operation may be limited to secured laboratory areas physically shielded from access or observation by unauthorized individuals. These areas must remain locked at all times. In high risk or particularly sensitive cases, the University Police should be informed of the location of sensitive data or materials and should be given the PI and UECO’s names and telephone numbers as contacts in the event of a security breach. The University Police may conduct a physical security survey and issue recommendations if desired.
     
  • Time Blocking. Project operation may be restricted to secure time blocks when unauthorized individuals cannot observe or access.
     
  • Marking. Export controlled information must be clearly identified and marked as export-controlled.
     
  • Personnel Identification. Individuals participating in the project may be required to wear a badge, special card, or other similar device indicating their access to designated project areas. Physical movement into and out of a designated project area may be logged. As may be necessary, the project may require electronically controlled card-access. Cost-estimates and implementation of electronic card access are available through the University’s Integrated Security Department.
     
  • Locked Storage. Tangible items such as equipment, associated operating manuals, and schematic diagrams should be stored in rooms with key-controlled access or other means of secure access control, such as proximity badges. Soft and hardcopy data, lab notebooks, reports, and other research materials should be stored in locked cabinets.
     
  • Electronic Security. Project computers, networks, and electronic transmissions should be secured and monitored through User Ids, password controls, 128-bit Secure Sockets Layer encryption or other federally approved encryption technology.
     
  • Confidential Communications. Discussions about the project must be limited to the identified and authorized project participants, and only in areas where unauthorized individuals are not present. Discussions with third party subcontractors must occur only under signed agreements which fully respect the non-U.S. citizen limitations for such disclosures.

C. Training & Certification 

Before any individual may observe or access controlled items, technology, he or she must be briefed on the procedures authorized under the TCP, certify his or her agreement to comply with all security measures outlined in the TCP, and have his or her certification authorized by the UECO or other authorized export controls individual. Export controls staff will complete the TCP in conjunction with the PI and at the PI’s discretion, his/her co-investigators and/or staff so that there is total transparency.