31948 Federal Register / Vol. 87, No. 102 / Thursday, May 26, 2022 / Rules and Regulations 

AIRAC date State City Airport FDC No. FDC date Subject 

16–Jun–22 ........ ID Grangeville .................. Idaho County .............. 2/8625 4/25/22 This NOTAM, published in Docket No. 31428, Amdt No. 4008, 

TL 22–13, (87 FR 29659, May 

16, 2022) is hereby rescinded 

in its entirety. 

16–Jun–22 ........ UT Milford ......................... Milford Muni/Ben And 

Judy Briscoe Fld.

2/4858 5/3/22 VOR/DME–A, Amdt 4. 

16–Jun–22 ........ DC Washington ................. Ronald Reagan Washington Ntl.2/5552 4/28/22 COPTER ILS OR LOC/DME 

RWY 1, Amdt 1A. 

16–Jun–22 ........ WI Janesville .................... Southern Wisconsin 

Rgnl.

2/5698 5/3/22 ILS OR LOC RWY 32, Amdt 1C. 

16–Jun–22 ........ WI Janesville .................... Southern Wisconsin 

Rgnl.

2/5700 5/3/22 RNAV (GPS) RWY 14, Amdt 1C. 

16–Jun–22 ........ WI Janesville .................... Southern Wisconsin 

Rgnl.

2/5705 5/3/22 RNAV (GPS) RWY 32, Orig–C. 

16–Jun–22 ........ AL Reform ........................ North Pickens ............. 2/7083 5/3/22 RNAV (GPS) RWY 1, Orig–B. 

16–Jun–22 ........ AL Reform ........................ North Pickens ............. 2/7084 5/3/22 RNAV (GPS) RWY 19, Amdt 1B. 

16–Jun–22 ........ AL Evergreen ................... Evergreen Rgnl/Middleton Fld.2/7087 5/3/22 RNAV (GPS) RWY 1, Amdt 1C. 

16–Jun–22 ........ AL Evergreen ................... Evergreen Rgnl/Middleton Fld.2/7088 5/3/22 RNAV (GPS) RWY 19, Amdt 1C. 

16–Jun–22 ........ AL Evergreen ................... Evergreen Rgnl/Middleton Fld.2/7089 5/3/22 RNAV (GPS) RWY 28, Amdt 1C. 

16–Jun–22 ........ AL Evergreen ................... Evergreen Rgnl/Middleton Fld.2/7090 5/3/22 VOR/DME RWY 10, Amdt 3B. 

16–Jun–22 ........ TX Hamilton ...................... Hamilton Muni ............. 2/7096 5/2/22 RNAV (GPS) RWY 18, Amdt 1D. 

16–Jun–22 ........ TX Hamilton ...................... Hamilton Muni ............. 2/7097 5/2/22 RNAV (GPS) RWY 36, Amdt 1D. 

16–Jun–22 ........ AR Huntsville .................... Huntsville Muni ........... 2/7207 5/3/22 RNAV (GPS) RWY 12, Orig–A. 

16–Jun–22 ........ AR Huntsville .................... Huntsville Muni ........... 2/7208 5/3/22 RNAV (GPS) RWY 30, Orig–A. 

16–Jun–22 ........ OK Guthrie ........................ Guthrie/Edmond Rgnl 2/7221 5/3/22 RNAV (GPS) RWY 16, Amdt 1. 

16–Jun–22 ........ OK Guthrie ........................ Guthrie/Edmond Rgnl 2/7222 5/3/22 RNAV (GPS) RWY 34, Amdt 1. 

16–Jun–22 ........ UT Cedar City ................... Cedar City Rgnl .......... 2/7263 5/3/22 RNAV (GPS) RWY 2, Orig. 

16–Jun–22 ........ UT Cedar City ................... Cedar City Rgnl .......... 2/7264 5/3/22 RNAV (GPS) RWY 20, Amdt 2. 

16–Jun–22 ........ VT Rutland ....................... Rutland—Southern 

Vermont Rgnl.

2/7277 5/3/22 ILS Z OR LOC Z RWY 19, Amdt 

1A. 

16–Jun–22 ........ NC Beaufort ...................... Michael J Smith Fld .... 2/7314 5/3/22 RNAV (GPS) RWY 3, Amdt 2A. 

16–Jun–22 ........ NC Beaufort ...................... Michael J Smith Fld .... 2/7315 5/3/22 RNAV (GPS) RWY 21, Amdt 2A. 

16–Jun–22 ........ NC Beaufort ...................... Michael J Smith Fld .... 2/7316 5/3/22 RNAV (GPS) RWY 14, Amdt 1A. 

16–Jun–22 ........ NC Beaufort ...................... Michael J Smith Fld .... 2/7317 5/3/22 RNAV (GPS) RWY 32, Amdt 1A. 

16–Jun–22 ........ WV Logan .......................... Logan County ............. 2/7340 5/3/22 RNAV (GPS) RWY 6, Amdt 1A. 

16–Jun–22 ........ AR Huntsville .................... Huntsville Muni ........... 2/7830 5/3/22 Takeoff Minimums and Obstacle 

DP, Orig. 

16–Jun–22 ........ SC Newberry .................... Newberry County ........ 2/8579 5/3/22 NDB RWY 22, Amdt 6B. 

16–Jun–22 ........ SC Newberry .................... Newberry County ........ 2/8580 5/3/22 RNAV (GPS) RWY 22, Orig–A. 

16–Jun–22 ........ SC Newberry .................... Newberry County ........ 2/8582 5/3/22 RNAV (GPS) RWY 4, Orig–A. 

16–Jun–22 ........ GA Claxton ........................ Claxton-Evans County 2/9330 5/3/22 RNAV (GPS) RWY 28, Amdt 1. 

16–Jun–22 ........ GA Claxton ........................ Claxton-Evans County 2/9349 5/3/22 RNAV (GPS) RWY 10, Amdt 2. 

[FR Doc. 2022–11250 Filed 5–25–22; 8:45 am] 

BILLING CODE 4910–13–P 

DEPARTMENT OF COMMERCE 

Bureau of Industry and Security 

15 CFR Parts 740, 772, and 774 

[Docket No. 220520–0118] 

RIN 0694–AH56 

Information Security Controls: 

Cybersecurity Items 

AGENCY: Bureau of Industry and 

Security, Commerce. 

ACTION: Final rule. 

SUMMARY: BIS is finalizing changes to 

License Exception ACE and 

corresponding changes in the definition 

section of the Export Administration 

Regulations (EAR) in response to public 

comments to an October 21, 2021 

interim rule. That rule established a 

new control on certain cybersecurity 

items for National Security (NS) and 

Anti-terrorism (AT) reasons, as well as 

adding a new License Exception 

Authorized Cybersecurity Exports (ACE) 

that authorizes exports of these items to 

most destinations except in certain 

circumstances. These items warrant 

controls because these tools could be 

used for surveillance, espionage, or 

other actions that disrupt, deny or 

degrade the network or devices on it. 

This rule also corrects Export Control 

Classification Number (ECCN) 5D001 in 

the Commerce Control List. 

DATES: This rule is effective May 26, 

2022. 

FOR FURTHER INFORMATION CONTACT: For 

questions regarding the Export Control 

Classification Numbers (ECCNs) 

included in this rule or License 

Exception ACE, contact Aaron 

Amundson at 202–482–0707 or email 

Aaron.Amundson@bis.doc.gov. 

SUPPLEMENTARY INFORMATION: 

Background 

In 2013, the Wassenaar Arrangement 

(WA) decided on new controls on 

cybersecurity items. The controls 

included hardware and software 

controls on the command and delivery 

platforms for ‘‘intrusion software’’, the 

technology for the ‘‘development’’, 

‘‘production’’ or ‘‘use’’ of the command 

and delivery platforms, and the 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 87, No. 102 / Thursday, May 26, 2022 / Rules and Regulations 31949 

technology for the ‘‘development’’ of 

‘‘intrusion software’’. On May 20, 2015, 

BIS published a proposed rule (80 FR 

28853) entitled ‘‘Wassenaar 

Arrangement 2013 Plenary Agreements 

Implementation: Intrusion and 

Surveillance Items,’’ which proposed 

implementing these controls and sought 

comments on their impact. 

In response to the proposed rule, BIS 

received almost 300 comments that 

raised substantial concerns about the 

proposed rule’s scope and the effect the 

proposed rule would have on legitimate 

cybersecurity research and incident 

response activities. BIS also conducted 

extensive outreach with the security 

industry, financial institutions, and 

government agencies that manage 

cybersecurity. 

Comments on the previously 

published proposed rule focused on 

three main issues. First, many 

commenters asserted that the entries 

were overly broad, captured more than 

was intended, and, as a technical 

matter, failed to accurately describe the 

items intended for control. Second, 

many commenters asserted that the rule 

as written imposed a heavy and 

unnecessary licensing burden on 

legitimate transactions that contribute to 

cybersecurity. Third, many commenters 

suggested that the proposed rule’s 

control on technology for the 

‘‘development’’ of ‘‘intrusion software’’ 

could cripple legitimate cybersecurity 

research. 

Based on these comments, the United 

States decided against amending the 

proposed rule and instead returned to 

the WA in 2016 and 2017 to negotiate 

changes to the text. In December 2017, 

the WA published the changes that 

resulted from those negotiations. There 

were three significant changes: First, 

using ‘‘command and control’’ in the 

control language for both hardware and 

software addressed concerns from 

cybersecurity companies to more 

specifically control tools that can be 

used maliciously; second, adding a note 

to the control entry for technology for 

the ‘‘development’’ of ‘‘intrusion 

software’’ that excludes from the entry 

‘‘technology’’ that is exchanged for 

‘‘vulnerability disclosure’’ or ‘‘cyber 

incident response’’; and third, adding a 

note to the ‘‘software’’ generation, 

command and control, or delivery entry 

that excludes from this entry products 

designed and limited to providing basic 

software updates and upgrades. 

On October 21, 2021 (86 FR 58205), 

the Bureau of Industry and Security 

(BIS) published an interim final rule 

(October 21 rule) that establishes new 

controls on certain cybersecurity items 

for National Security (NS) and Antiterrorism (AT) reasons, along with a 

new License Exception, Authorized 

Cybersecurity Exports (ACE), that 

authorizes exports of these items to 

most destinations except in specified 

circumstances. That rule was published 

with a 45-day comment period, which 

ended on December 12, 2021, and a 90- 

day delayed effective date (January 19, 

2022). A total of 12 comments were 

received. On January 12, 2022 (87 FR 

1670), BIS published a rule that further 

delayed the effective date of the interim 

final rule by 45 days (March 7, 2022). 

That action did not extend or reopen the 

comment period for BIS’s previous 

request for comments on the interim 

final rule. Consistent with the 

comments received, this action amends 

the October 21 rule that became 

effective March 7, 2022. 

Public Comments on the October 21 

Rule 

Comments Requesting Additional 

Guidance 

Several commenters stated that the 

new 5A001.j entry is complex and 

therefore presents compliance 

difficulties. One commenter asked 

whether 5A001.j would control 

cybersecurity incident detection and 

monitoring software. Another 

commenter stated that 5A001.j systems 

have numerous components, all of 

which will need to be examined under 

the new entry. In response, BIS is 

providing additional information and 

guidance through ‘‘Frequently Asked 

Questions’’ (FAQs) on 5A001.j to clarify 

these interpretation issues. BIS does not 

expect 5A001.j to control a large number 

of products, and therefore believes these 

issues can be addressed in the FAQs. 

Several commenters recommended 

that BIS devote additional resources to 

conducting outreach to exporters about 

the interim final rule. One commenter 

recommended a decision tool for ACE 

like the one used for License Exception 

Strategic Trade Authorization (STA), as 

well as more FAQs. Another said BIS 

should put more resources towards 

outreach to the cybersecurity 

community. One commenter 

recommended developing additional 

guidelines to help exporters with the 

interim final rule. BIS agrees with these 

comments and is working on providing 

additional guidance along these lines. 

Several commenters asked for 

clarification of BIS’s ‘‘reason to know’’ 

standard. One commenter said that the 

end-use based control uses the phrase 

‘‘knows or has reason to know’’ and 

asked if this was supposed to be 

different from the ‘‘knowledge’’ 

standard. Others recommended BIS 

provide guidelines on when an exporter 

would have ‘‘reason to know’’ 

something will be used for unauthorized 

surveillance. The terms ‘‘know’’ and 

‘‘reason to know’’ use the same 

definition found in § 772.1 of the EAR 

as the term ‘‘knowledge,’’ which is the 

one that should be used for this rule. 

BIS has published extensive ‘‘Know 

Your Customer’’ guidance in 

supplement no. 3 to part 732 of the EAR 

and on its website. That information 

also applies to transactions under 

license exception ACE. BIS believes the 

current guidance is sufficient to address 

the questions raised by the commenters 

and declines to provide additional 

sector-specific guidance for this area 

beyond what is published on the 

website. 

Comments Requiring Regulatory 

Changes 

Several commenters stated that the 

definition of ‘government end user’ in 

ACE is vague and will be difficult to 

apply. Two commenters stated that 

there is some potential overlap between 

‘government end users’ and ‘favorable 

treatment cybersecurity end users’. BIS 

agrees with this recommendation and 

makes changes to the definition of 

‘government end user’ to be more 

specific and to clarify the meaning of 

this term. 

One commenter stated that the 

licensing requirement for people acting 

on behalf of a ‘government end user’ 

will chill cross-border collaboration 

with cybersecurity researchers and bug 

bounty hunters because exporters will 

be required to check whether an 

individual has a government affiliation 

before communicating with them. The 

company recommends BIS either 

remove this requirement or modify it. 

BIS disagrees with this 

recommendation. The license 

requirement for people acting on behalf 

of a government is necessary to prevent 

people who are acting on behalf of a 

Country Group D government from 

obtaining ‘cybersecurity items’ for 

activities contrary to U.S. national 

security and foreign policy interests. 

Removing this requirement would risk 

allowing Country Group D governments 

access to those items. BIS agrees that 

this means that exporters will in some 

cases have to check government 

affiliation of people and companies they 

work with. However, because of the 

limited scope and applicability of the 

license requirement, BIS believes the 

requirement will protect U.S. national 

security and foreign policy interests 

without unduly impacting legitimate 

cybersecurity activities. 


khammond on DSKJM1Z7X2PROD with RULES
31950 Federal Register / Vol. 87, No. 102 / Thursday, May 26, 2022 / Rules and Regulations 

A couple of commenters stated that 

the definitions of ‘‘vulnerability 

disclosure’’ and ‘‘cyber incident 

response’’ are too narrow. One 

commenter said that researchers share 

vulnerability information unrelated to 

remediation of a specific vulnerability 

or incident. Another said the definitions 

should include information that is not 

strictly ‘‘necessary’’ for vulnerability 

disclosure or cyber incident response 

activities, as well as information that is 

needed to prevent cyber incidents from 

happening. One commenter 

recommended expanding the exclusion 

to include preventative remediation and 

coordination activities. They 

recommend two possible solutions: (1) 

Amend FAQs to clarify that the carveout covers routine sharing of exploits for 

cybersecurity purposes; or (2) amend 

the definition of fundamental research 

to include transferring exploit 

information for research purposes. BIS 

believes that many of the activities 

commenters mentioned as being subject 

to a license requirement, such as tactics 

and techniques of malicious actors, and 

identifying products that contain 

vulnerabilities, are not subject to this 

control and that therefore the scope of 

items that would require a license in 

this area is significantly smaller than the 

commenters asserted. Therefore, BIS is 

not amending the rule but will clarify 

the scope of license requirements in this 

area via guidance in FAQs. 

Other Significant Comments 

One commenter suggested extending 

the comment period to January 5, 2022. 

Another recommended delaying the 

effective date of the rule and conducting 

more extensive industry consultations 

and engagements. In response, BIS 

delayed the implementation date of the 

October 21 rule to March 7, 2022, and 

reached out to interested industry 

members of BIS’s Technical Advisory 

Committees to prepare additional 

guidance and make clarifications that 

are in this final rule. 

Several commenters said the rule is 

complicated and will be difficult for 

people to understand and implement. In 

response, BIS has made several changes 

in this final rule to clarify the scope of 

controls. In addition, BIS delayed the 

implementation date of the October 21 

rule to March 7, 2022, which allowed 

for the preparation of additional 

guidance to assist with compliance. 

One commenter said that the 

estimated yearly expense of compliance 

of $2,520 is a gross underestimation, 

because the complexity of the rule will 

increase the cost of compliance. 

However, none of the commenters 

provided data to substantiate this claim 

or provided another estimate. BIS 

consulted with its Technical Advisory 

Committees to develop the estimate 

yearly expense identified in this rule. 

Specific Revisions 

Section 740.17 License Exception 

Encryption Commodities, Software, and 

Technology (ENC) 

BIS is revising § 740.17 by adding a 

new end-use restriction (§ 740.17(f)) 

equivalent to the end-use restriction in 

§ 740.22(c)(4) of License Exception ACE, 

so that License Exception ENC is not 

authorized if the exporter, reexporter, or 

transferor ‘‘knows’’ or has ‘‘reason to 

know’’ at the time of export, reexport, or 

transfer (in-country), including deemed 

exports and reexports, that the following 

items will be used to affect the 

confidentiality, integrity or availability 

of information or information systems, 

without authorization by the owner, 

operator or administrator of the 

information system (including the 

information and processes within such 

systems): ‘‘cryptanalytic items’’, 

classified in ECCN 5A004.a, 5D002.a.3.a 

or c.3.a, or 5E002; network penetration 

tools described in § 740.17(b)(2)(i)(F), 

and ECCN 5E002 ‘‘technology’’ therefor; 

or automated network vulnerability 

analysis and response tools described in 

§ 740.17(b)(3)(iii)(A), and ECCN 5E002 

‘‘technology’’ therefor. This conforming 

change is necessary to avoid an 

unintended circumstance in which the 

§ 740.22(c)(4) License Exception ACE 

end-use restriction could be evaded by 

adding cryptographic or cryptanalytic 

functionality to the ‘cybersecurity item’ 

and exporting, reexporting or 

transferring (in-country) the resulting 

‘encryption item’ subject to the EAR 

under License Exception ENC. 

Section 740.22 License Exception 

Authorized Cybersecurity Exports 

(ACE) 

In response to public comments, BIS 

is revising § 740.22. BIS is revising the 

definition of the term ‘Government end 

user’ as defined in § 740.22(b)(4) of 

License Exception ACE by adding a 

detailed illustrative list of end users that 

meet this definition. Included in the list 

are two types of government end users 

that are already defined in the EAR, 

‘‘more-sensitive government end users’’ 

and ‘‘less-sensitive government end 

users’’. BIS also added a note to define 

‘partially operated or owned by a 

government or governmental authority’ 

to guide the public in understanding 

this phrase, which is used in three of 

the listed ‘government end users’ related 

to utilities; transportation hubs and 

services; and retail or wholesale firms 

engaged in the manufacture, 

distribution, or provision of items or 

services specified in the Wassenaar 

Arrangement Munitions List. 

BIS also revised the format of the 

restrictions in § 740.22(c) by collapsing 

the levels and moving most of the text 

that was in notes to subordinate 

paragraphs within paragraph (c). Several 

people commented that the double 

negative structure of the restrictions 

paragraph was confusing. BIS believes 

the more simplified paragraph 

organization will alleviate the 

confusion. 

Finally, BIS is amending 

§ 740.22(c)(2)(i) to correct the text, 

which inadvertently increased the scope 

of the exception. As currently written, 

that paragraph allows (a) exports of 

‘digital artifacts’ to anyone in a Country 

Group D country that is also listed in 

Country Group A:6; and (b) exports of 

any ‘cybersecurity item’ to police or 

judicial bodies to Country Group D 

countries that are also listed in Country 

Group A:6. However, BIS intended to 

only allow exports of ‘digital artifacts’ to 

police or judicial bodies in Country 

Group D countries that are also listed in 

Country Group A:6 for purposes of 

criminal or civil investigations or 

prosecutions. These changes correct the 

text to reflect the intended scope. 

Part 772—Definitions of Terms 

This rule amends the terms ‘‘Less 

sensitive government end users’’ and 

‘‘More sensitive government end users’’ 

to indicate that the terms apply to 

cybersecurity items and are now 

referenced in License Exception ACE 

(§ 740.22). 

Part 774—Commerce Control List: 

ECCN 5D001 

This rule corrects an error made to 

ECCN 5D001in the October 21, 2021 

interim rule. That rule inadvertently 

removed 5D001.e and this rule restores 

5D001.e. 

Export Control Reform Act of 2018 

On August 13, 2018, the President 

signed into law the John S. McCain 

National Defense Authorization Act for 

Fiscal Year 2019, which included the 

Export Control Reform Act of 2018 

(ECRA), 50 U.S.C. Sections 4801–4852. 

ECRA provides the legal basis for BIS’s 

principal authorities and serves as the 

authority under which BIS issues this 

rule. 

Executive Order Requirements 

This final rule has been designated a 

‘‘significant regulatory action’’ under 

Executive Order 12866. 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 87, No. 102 / Thursday, May 26, 2022 / Rules and Regulations 31951 

This rule does not contain policies 

with federalism implications as that 

term is defined under Executive Order 

13132. 

Paperwork Reduction Act 

Requirements 

Notwithstanding any other provision 

of law, no person is required to respond 

to, nor shall any person be subject to a 

penalty for failure to comply with a 

collection of information subject to the 

requirements of the Paperwork 

Reduction Act (PRA) of 1995 (44 U.S.C. 

3501 et seq.) unless a valid Office of 

Management and Budget (OMB) Control 

Number is displayed. While there is no 

collection of information associated 

with using License Exception ACE, this 

rule does involve a collection of 

information currently approved under 

Control Number 0694–0088, MultiPurpose Application. The current 

burden hour estimate for this collection 

is 29.6 minutes for a manual or 

electronic submission. 

For the existing ECCNs included in 

this rule (4D001, 4E001, 5A001, 5A004, 

5D001, 5E001), the 2020 data from the 

Automated Export System (AES) shows 

980 shipments valued at $39,146,164. 

Of those shipments, 120 shipments 

valued at $1,864,699 went to Country 

Group D:1 or D:5 countries, which 

would make them ineligible for License 

Exception ACE. There were no 

shipments to Country Group E:1 or E:2. 

Under the provisions of this rule, the 

120 shipments require a license 

application submission to BIS. 

As there is no specific ECCN data in 

AES for the new export controls in new 

ECCNs 4A005 and 4D004 or new 

paragraph 4E001.c, BIS has used other 

data to estimate the number of 

shipments of these new ECCNs that will 

require a license. Bureau of Economic 

Analysis (BEA) data from 2019 show a 

total dollar value of $55,657,000 for 

Telecom, Computer, and Information 

Technology Services exports. 

Multiplying this value by 12.1% (the 

percentage of all exports that are subject 

to an EAR license requirement as 

determined by using AES data) suggests 

that $6,734,497,000 of Telecom/ 

Computer/IT exports are now subject to 

EAR license requirements. Based on 

AES data on the existing ECCNs affected 

by this rule, BIS estimates the average 

value of each shipment for the new 

ECCNs at about $40,000, and further 

estimates that 0.6% of all new ECCN 

shipments (1,010 shipments) are now 

eligible for License Exception ACE and 

0.03% of all new ECCN shipments (50 

shipments) require a license application 

submission. 

Therefore, the annual total estimated 

cost associated with the paperwork 

burden imposed by this rule (that is, the 

projected increase of license application 

submissions based on the additional 

shipments requiring a license) is 

estimated to be 170 new applications × 

29.6 minutes = 5,032/60 min = 84 hours 

× $30 = $2,520. 

BIS is in the process of updating this 

information collection to account for the 

increase in burden hours and costs 

posed by this rule. Comments on the 

methodology associated with 

calculating the cost or burden increases 

or any other aspect of this collection can 

be submitted via www.regulations.gov 

by searching for OMB Control Number 

0694–0088. 

Administrative Procedure Act and 

Regulatory Flexibility Act 

Requirements 

Pursuant to Section 4821 of ECRA, 

this action is exempt from the 

Administrative Procedure Act (5 U.S.C. 

553) requirements for notice of 

proposed rulemaking and opportunity 

for public participation. Further, no 

other law requires notice of proposed 

rulemaking or opportunity for public 

comment for this final rule. Because a 

notice of proposed rulemaking and an 

opportunity for public comment are not 

required under the Administrative 

Procedure Act or by any other law, the 

analytical requirements of the 

Regulatory Flexibility Act (5 U.S.C. 601 

et seq.) are not applicable. 

List of Subjects 

15 CFR Part 740 

Administrative practice and 

procedure, Exports, Reporting and 

recordkeeping requirements. 

15 CFR Part 772 

Exports. 

15 CFR Part 774 

Exports, Reporting and recordkeeping 

requirements. 

Accordingly, the interim rule 

amending 15 CFR parts 740, 772, and 

774, which was published on October 

21, 2021 (86 FR 58205), is adopted as 

final with the following changes: 

PART 740 [AMENDED] 

■ 1. The authority citation for part 740 

continues to read as follows: 

Authority: 50 U.S.C. 4801–4852; 50 U.S.C. 

4601 et seq.; 50 U.S.C. 1701 et seq.; 22 U.S.C. 

7201 et seq.; E.O. 13026, 61 FR 58767, 3 CFR, 

1996 Comp., p. 228; E.O. 13222, 66 FR 44025, 

3 CFR, 2001 Comp., p. 783. 

■ 2. Section 740.17 is revised by adding 

paragraph (f) to read as follows: 

§ 740.17 Encryption commodities, 

software, and technology (ENC). 

* * * * * 

(f) End-use restrictions. 

Notwithstanding the other provisions 

and authorizations of this section, 

License Exception ENC is not 

authorized for any of the following 

items if the exporter, reexporter, or 

transferor ‘‘knows’’ or has ‘‘reason to 

know’’ at the time of export, reexport, or 

transfer (in-country), including deemed 

exports and reexports, that the item will 

be used to affect the confidentiality, 

integrity, or availability of information 

or information systems, without 

authorization by the owner, operator, or 

administrator of the information system 

(including the information and 

processes within such systems): 

(1) ‘‘Cryptanalytic items,’’ classified 

in ECCN 5A004.a, 5D002.a.3.a or c.3.a, 

or 5E002; 

(2) Network penetration tools 

described in paragraph (b)(2)(i)(F) of 

this section, and ECCN 5E002 

‘‘technology’’ therefor; or 

(3) Automated network vulnerability 

analysis and response tools described in 

paragraph (b)(3)(iii)(A) of this section, 

and ECCN 5E002 ‘‘technology’’ therefor. 

Note to paragraph (f): See also 

§ 740.22(c)(4). 

■ 3. Section 740.22 is revised to read as 

follows: 

§ 740.22 Authorized Cybersecurity Exports 

(ACE). 

(a) Scope. License Exception ACE 

authorizes export, reexport, and transfer 

(in-country), including deemed exports 

and reexports, of ‘cybersecurity items,’ 

as set forth in paragraph (b) of this 

section, subject to the restrictions set 

forth in paragraph (c) of this section. 

Deemed exports and reexports are 

authorized under this license exception, 

except for deemed exports or reexports 

to E:1 and E:2 nationals as described in 

paragraph (c)(1) of this section, to 

certain ‘government end users’ as 

described in paragraph (c)(2) of this 

section, and subject to the end use 

restrictions described in paragraph (c)(4) 

of this section. Even if License 

Exception ACE is not available for a 

particular transaction, other license 

exceptions may be available. For 

example, License Exception GOV 

(§ 740.11) authorizes certain exports to 

U.S. Government agencies and 

personnel. License Exception TMP 

(§ 740.9(a)(1)) authorizes the export, 

reexport, and transfer (in country) of 

tools of the trade in certain situations. 

(b) Definitions. The following terms 

and definitions are for the purpose of 

License Exception ACE only. 


khammond on DSKJM1Z7X2PROD with RULES
31952 Federal Register / Vol. 87, No. 102 / Thursday, May 26, 2022 / Rules and Regulations 

(1) ‘Cybersecurity Items’ are ECCNs 

4A005, 4D001.a (for 4A005 or 4D004), 

4D004, 4E001.a (for 4A005, 4D001.a (for 

4A005 or 4D004) or 4D004), 4E001.c, 

5A001.j, 5B001.a (for 5A001.j), 5D001.a 

(for 5A001.j), 5D001.c (for 5A001.j or 

5B001.a (for 5A001.j)), and 5E001.a (for 

5A001.j or 5D001.a (for 5A001.j)). 

(2) ‘Digital artifacts’ are items (e.g., 

‘‘software’’ or ‘‘technology’’) found or 

discovered on an information system 

that show past or present activity 

pertaining to the use or compromise of, 

or other effects on, that information 

system. 

(3) ‘Favorable treatment cybersecurity 

end user’ is any of the following: 

(i) A ‘‘U.S. subsidiary’’; 

(ii) Providers of banking and other 

financial services; 

(iii) Insurance companies; or 

(iv) Civil health and medical 

institutions providing medical treatment 

or otherwise conducting the practice of 

medicine, including medical research. 

(4) ‘Government end user,’ for the 

purpose of this section, is a national, 

regional, or local department, agency, or 

entity that provides any governmental 

function or service, including entities or 

individuals who are acting on behalf of 

such an entity. This term does not 

include any ‘favorable treatment 

cybersecurity end user’ listed in 

paragraph (b)(3) of this section. This 

term includes, but is not limited to: 

(i) International governmental 

organizations; 

(ii) Government operated research 

institutions; 

(iii) ‘‘More-sensitive government end 

users’’; 

(iv) ‘‘Less-sensitive government end 

users’’; 

(v) Utilities (including 

telecommunications service providers 

and internet service providers) that are 

wholly operated or owned by a 

government or governmental authority 

or ‘partially operated or owned by a 

government or governmental authority’; 

(vi) Transportation hubs and services 

(e.g., airlines and airports; ships and 

ports; railways and rail stations; buses, 

trucking and highways) that are wholly 

operated or owned by a government or 

governmental authority or ‘partially 

operated or owned by a government or 

governmental authority’; and 

(vii) Retail or wholesale firms that are 

wholly operated or owned by a 

government or governmental authority 

or ‘partially operated or owned by a 

government or by a governmental 

authority’, engaged in the manufacture, 

distribution, or provision of items or 

services specified in the Wassenaar 

Arrangement Munitions List. 

(5) For the purposes of this section, 

‘partially operated or owned by a 

government or governmental authority’ 

means that a foreign government or 

governmental authority beneficially 

owns or controls (whether directly or 

indirectly) 25 percent or more of the 

voting securities of the foreign entity, or 

a foreign government or governmental 

authority has the authority to appoint a 

majority of the members of the board of 

directors of the foreign entity. 

(c) Restrictions. License Exception 

ACE does not authorize deemed exports 

and reexports, exports, reexports, or 

transfers (in-country) of ‘cybersecurity 

items’ as follows: 

(1) To a destination that is listed in 

Country Group E:1 or E:2 in supplement 

no.1 to this part. 

(2) To a ‘government end user’, as 

defined in this section, of any country 

listed in Country Group D:1, D:2, D:3, 

D:4 or D:5 in supplement no. 1 to this 

part, except: 

(i) ‘Digital artifacts’ (that are related to 

a cybersecurity incident involving 

information systems owned or operated 

by a ‘favorable treatment cybersecurity 

end user’) to police or judicial bodies in 

Country Group D countries that are also 

listed in Country Group A:6 for 

purposes of criminal or civil 

investigations or prosecutions of such 

cybersecurity incidents; or 

(ii) To national computer security 

incident response teams in Country 

Group D countries that are also listed in 

Country Group A:6 of ‘cybersecurity 

items’ for purposes of responding to 

cybersecurity incidents, for purposes of 

‘‘vulnerability disclosure’’, or for 

purposes of criminal or civil 

investigations or prosecutions of such 

cybersecurity incidents. 

(3) The restrictions in paragraphs 

(c)(1) and (2) of this section also apply 

to activities, including exports, 

reexports, and transfers (in-country), 

related to ‘‘vulnerability disclosure’’ and 

‘‘cyber incident response’’. 

Note 1 to paragraph (c)(3): For paragraphs 

(c)(1) and (2) of this section, see Note 1 to 

ECCN 4E001 in the CCL (supplement no. 1 

to part 774 of the EAR) excluding 

‘‘vulnerability disclosure’’ and ‘‘cyber 

incident response’’ from control under 

4E001.a or .c. 

(4) To a non-‘government end user’ 

located in any country listed in Country 

Group D:1 or D:5 of supplement no. 1 

to this part, except: 

(i) Cybersecurity items classified 

under ECCNs 4A005, 4D001.a (for 

4A005 or 4D004), 4D004, 4E001.a (for 

4A005, 4D001.a (for 4A005 or 4D004) or 

4D004) and 4E001.c, to any ‘favorable 

treatment cybersecurity end user’. 

(ii) ‘‘Vulnerability disclosure’’ or 

‘‘cyber incident response’’. 

(iii) Deemed exports. 

(5) If the exporter, reexporter, or 

transferor ‘‘knows’’ or has ‘‘reason to 

know’’ at the time of export, reexport, or 

transfer (in-country), including deemed 

exports and reexports, that the 

‘cybersecurity item’ will be used to 

affect the confidentiality, integrity, or 

availability of information or 

information systems, without 

authorization by the owner, operator, or 

administrator of the information system 

(including the information and 

processes within such systems). 

PART 772 [AMENDED] 

■ 4. The authority citation for part 772 

continues to read as follows: 

Authority: 50 U.S.C. 4801–4852; 50 U.S.C. 

4601 et seq.; 50 U.S.C. 1701 et seq.; E.O. 

13222, 66 FR 44025, 3 CFR, 2001 Comp., p. 

783. 

■ 5. Section 772.1 is amended by 

revising the definitions ‘‘Less sensitive 

government end users’’ and ‘‘More 

sensitive government end users’’ to read 

as follows: 

§ 772.1 Definitions of terms as used in the 

Export Administration Regulations (EAR). 

* * * * * 

Less sensitive government end users 

(as applied to encryption items and 

‘cybersecurity items’). The following 

‘‘government end users’’ (as defined in 

this section) are considered ‘‘less 

sensitive’’ for the purposes of License 

Exception ENC (§ 740.17 of the EAR) 

and License Exception ACE (§ 740.22 of 

the EAR): 

(1) Local/state/provincial 

‘‘government end users’’ (departments, 

agencies, and entities), including local/ 

state/provincial executive, legislative, 

judicial, police, fire, rescue, and public 

safety agencies. 

(2) National/federal/royal 

‘‘government end users’’ (departments, 

agencies, and entities) providing the 

following civil government functions 

and services: 

(i) Census and statistics services; 

(ii) Civil public works infrastructure 

services (construction, maintenance, 

repair, regulation, and administration) 

as follows: Buildings, public 

transportation, roads and highways, 

trucking; 

(iii) Civil service administration and 

regulation, including human resources 

and personnel/labor management; 

(iv) Clean water infrastructure 

services (treatment, supply and testing); 

(v) Economic (trade/commerce/ 

investment), business and industrial 

development, promotion, regulation and 


khammond on DSKJM1Z7X2PROD with RULES
Federal Register / Vol. 87, No. 102 / Thursday, May 26, 2022 / Rules and Regulations 31953 

administration, excluding the following 

end users/end uses: 

(A) Agencies, departments, boards, 

and councils for science and 

technology; 

(B) Research, development, and 

national laboratories (other than as 

specified in paragraphs (2)(xi) 

(measurements and standards services) 

and (2)(xii) (meteorology/weather/ 

atmospheric services) of this definition); 

and 

(C) National telecommunications and 

information technology agencies, 

boards, councils, and development 

authorities (including national 

information center, and Information 

Communications Technology (ICT)/ 

telecommunications infrastructure/ 

spectrum planning, policy, regulation, 

and testing); 

(vi) Elections, balloting, and polling 

services; 

(vii) Energy regulation and 

administration, including oil, gas, and 

mining sectors; 

(viii) Environmental/natural resources 

regulation, administration, and 

protection, including wildlife, fisheries, 

and national parks; 

(ix) Food/agriculture regulation and 

administration; 

(x) Labor/community/social services 

planning, regulation, and 

administration, including: Housing and 

urban development, municipality and 

rural affairs; 

(xi) Measurements and standards 

services; 

(xii) Meteorology (weather, 

atmospheric) services; 

(xiii) National archives/museums; 

(xiv) Patents; 

(xv) Pilgrimage and religious affairs; 

(xvi) Postal services; 

(xvii) Public and higher education 

(excluding government research 

institutions and any agency, institution, 

or affiliate engaged in the manufacture 

or distribution of items or services 

controlled on the Wassenaar Munitions 

List); 

(xviii) Public health and medicine/ 

pharmaceutical regulation and 

administration; 

(xix) Public libraries; 

(xx) Sports/culture (includes film, 

commercial broadcasting, and the arts) 

promotion, regulation, and 

administration; and 

(xxi) Travel/tourism promotion, 

regulation, and administration. 

* * * * * 

More sensitive government end users 

(as applied to encryption items and 

‘cybersecurity items’). The following 

national/federal/royal (departments, 

agencies, and entities) ‘‘government end 

users’’ (as defined in this section) 

providing the following government 

functions and services, are considered 

‘‘more sensitive’’ for the purposes of 

License Exception ENC (§ 740.17 of the 

EAR) and License Exception ACE 

(§ 740.22 of the EAR): 

(1) Agencies, departments, boards, 

and councils for science and technology 

(including research, development, and 

state/national laboratories, but not 

including measurements and standards); 

(2) Currency and monetary authorities 

(including departments and offices of 

the national/federal/royal reserve); 

(3) Executive agents of state 

(including offices of president/vice 

president/prime minister, royal courts, 

national security councils, cabinet/ 

council of ministers/supreme councils/ 

executive councils, crown princes and 

other deputies of the rulers, 

departments and offices of political/ 

constitutional/mainland affairs); 

(4) Legislative bodies responsible for 

the enactment of laws; 

(5) Import/export control, customs 

and immigration agencies, and entities; 

(6) Intelligence agencies and entities; 

(7) Judiciary (including supreme 

courts and other national/federal/ 

regional/royal high courts and 

tribunals); 

(8) Maritime, port, railway, and 

airport authorities; 

(9) Military and armed services 

(including national guard, coast guard, 

security bureaus, and paramilitary); 

(10) Ministries, departments, and 

garrisons of defense (including defense 

technology agencies); 

(11) Ministries and departments of 

finance and taxation (including 

national/federal/royal budget and 

revenue authorities); 

(12) Ministries and departments of 

foreign affairs/foreign relations/ 

consulates/embassies; 

(13) Ministries of interior, internal/ 

home/mainland affairs, and homeland 

security; 

(14) State/national 

telecommunications and information 

technology agencies, boards, councils, 

and development authorities (including 

national information/critical 

infrastructure data centers, and 

Information and Communications 

Technology (ICT)/telecommunications 

infrastructure/spectrum planning, 

policy, regulation, and testing); 

(15) Police, investigation and other 

law enforcement agencies, and entities 

(including digital crime/cybercrime/ 

computer forensics, counter narcotics/ 

counter terrorism/counter proliferation 

agencies); 

(16) Prisons; and 

(17) Public safety agencies and 

entities (including national/federal/ 

royal agencies and departments of civil 

defense, emergency management, and 

first responders). 

* * * * * 

PART 774 [AMENDED] 

■ 6. The authority citation for part 774 

continues to read as follows: 

Authority: 50 U.S.C. 4801–4852; 50 U.S.C. 

4601 et seq.; 50 U.S.C. 1701 et seq.; 10 U.S.C. 

8720; 10 U.S.C. 8730(e); 22 U.S.C. 287c, 22 

U.S.C. 3201 et seq.; 22 U.S.C. 6004; 42 U.S.C. 

2139a; 15 U.S.C. 1824; 50 U.S.C. 4305; 22 

U.S.C. 7201 et seq.; 22 U.S.C. 7210; E.O. 

13026, 61 FR 58767, 3 CFR, 1996 Comp., p. 

228; E.O. 13222, 66 FR 44025, 3 CFR, 2001 

Comp., p. 783. 

■ 7. In supplement no. 1 to part 774, 

Category 5—Part 1, ECCN 5D001 is 

revised to read as follows: 

Supplement No. 1 to Part 774—The 

Commerce Control List 

* * * * * 

5D001 ‘‘Software’’ as follows (see List of 

Items Controlled). 

License Requirements 

Reason for Control: NS, SL, AT 

Control(s) 

Country chart 

(see Supp. No. 1 to 

part 738) 

NS applies to entire 

entry.

NS Column 1 

SL applies to the entire entry as applicable for equipment, functions, 

features, or characteristics controlled 

by 5A001.f.1.

A license is required 

for all destinations, 

as specified in 

§ 742.13 of the 

EAR. Accordingly, 

a column specific to 

this control does 

not appear on the 

Commerce Country 

Chart (Supplement 

No. 1 to Part 738 of 

the EAR). 

Note to SL paragraph: This licensing requirement 

does not supersede, nor does it 

implement, construe or limit the 

scope of any criminal statute, including, but not limited 

to the Omnibus 

Safe Streets Act of 

1968, as amended. 

AT applies to entire 

entry.

AT Column 1 

Reporting Requirements 

See § 743.1 of the EAR for reporting 

requirements for exports under License 

Exceptions, and Validated End-User 

authorizations. 

List Based License Exceptions 

(See Part 740 for a description of all license 

exceptions). 


khammond on DSKJM1Z7X2PROD with RULES
31954 Federal Register / Vol. 87, No. 102 / Thursday, May 26, 2022 / Rules and Regulations 

TSR: Yes, except for exports and reexports to 

destinations outside of those countries 

listed in Country Group A:5 (See 

Supplement No. 1 to part 740 of the EAR) 

of ‘‘software’’ controlled by 5D001.a and 

‘‘specially designed’’ for items controlled 

by 5A001.b.5 and 5A001.h, and N/A for 

‘‘software’’ classified under ECCN 5D001.a 

(for 5A001.j) or 5D001.c (for 5A001.j or 

5B001.a (for 5A001.j)). 

ACE: Yes for 5D001.a (for 5A001.j) and 

5D001.c (for 5A001.j or 5B001.a (for 

5A001.j)), except to Country Group E:1 or 

E:2. See § 740.22 of the EAR for eligibility 

criteria. 

Special Conditions for STA 

STA: License Exception STA may not be 

used to ship or transmit 5D001.a 

‘‘software’’ ‘‘specially designed’’ for the 

‘‘development’’ or ‘‘production’’ of 

equipment, functions or features, specified 

by ECCN 5D001.a (for 5A001.j) and 

5D001.c (for 5A001.j or 5B001.a (for 

5A001.j)) to any of the destinations listed 

in Country Group A:5 or A:6 (See 

Supplement No.1 to part 740 of the EAR); 

5A001.b.3, .b.5 or .h; and for 5D001.b. for 

‘‘software’’ ‘‘specially designed’’ or 

modified to support ‘‘technology’’ 

specified by the STA paragraph in the 

License Exception section of ECCN 5E001 

to any of the destinations listed in Country 

Group A:6. 

List of Items Controlled 

Related Controls: See also 5D980 and 5D991. 

Related Definitions: N/A 

Items: 

a. ‘‘Software’’ ‘‘specially designed’’ or 

modified for the ‘‘development’’, 

‘‘production’’ or ‘‘use’’ of equipment, 

functions or features controlled by 5A001; 

b. [Reserved] 

c. Specific ‘‘software’’ ‘‘specially designed’’ 

or modified to provide characteristics, 

functions or features of equipment, 

controlled by 5A001 or 5B001; 

d. ‘‘Software’’ ‘‘specially designed’’ or 

modified for the ‘‘development’’ of any of the 

following telecommunication transmission or 

switching equipment: 

d.1. [Reserved] 

d.2. Equipment employing a ‘‘laser’’ and 

having any of the following: 

d.2.a. A transmission wavelength 

exceeding 1,750 nm; or 

d.2.b. Employing analog techniques and 

having a bandwidth exceeding 2.5 GHz; or 

Note: 5D001.d.2.b does not control 

‘‘software’’ ‘‘specially designed’’ or modified 

for the ‘‘development’’ of commercial TV 

systems. 

d.3. [Reserved] 

d.4. Radio equipment employing 

Quadrature-Amplitude-Modulation (QAM) 

techniques above level 1,024. 

e. ‘‘Software’’, other than that specified by 

5D001.a or 5D001.c, ‘‘specially designed’’ or 

modified for monitoring or analysis by law 

enforcement, providing all of the following: 

e.1. Execution of searches on the basis of 

‘‘hard selectors’’ of either the content of 

communication or metadata acquired from a 

communications service provider using a 

‘handover interface’; and 

Technical Notes: 

1. For the purposes of 5D001.e, a ‘handover 

interface’ is a physical and logical interface, 

designed for use by an authorised law 

enforcement authority, across which targeted 

interception measures are requested from a 

communications service provider and the 

results of interception are delivered from a 

communications service provider to the 

requesting authority. The ‘handover 

interface’ is implemented within systems or 

equipment (e.g., mediation devices) that 

receive and validate the interception request, 

and deliver to the requesting authority only 

the results of interception that fulfil the 

validated request. 

2. ‘Handover interfaces’ may be specified 

by international standards (including but not 

limited to ETSI TS 101 331, ETSI TS 101 671, 

3GPP TS 33.108) or national equivalents. 

e.2. Mapping of the relational network or 

tracking the movement of targeted 

individuals based on the results of searches 

on content of communication or metadata or 

searches as described in 5D001.e.1. 

Note: 5D001.e does not apply to ‘‘software’’ 

‘‘specially designed’’ or modified for any of 

the following: 

a. Billing purposes; 

b. Network Quality of Service (QoS); 

c. Quality of Experience (QoE); 

d. Mediation devices; or 

e. Mobile payment or banking use. 

* * * * * 

Matthew S. Borman, 

Deputy Assistant Secretary for Export 

Administration. 

[FR Doc. 2022–11282 Filed 5–25–22; 8:45 am] 

BILLING CODE 3510–33–P 

DEPARTMENT OF HEALTH AND 

HUMAN SERVICES 

Food and Drug Administration 

21 CFR Part 251 

[Docket No. FDA–2021–D–0958] 

Importation of Prescription Drugs Final 

Rule Questions and Answers; 

Guidance for Industry: Small Entity 

Compliance Guide; Availability 

AGENCY: Food and Drug Administration, 

HHS. 

ACTION: Notification of availability. 

SUMMARY: The Food and Drug 

Administration (FDA, Agency, or we) is 

announcing the availability of a final 

guidance for industry entitled 

‘‘Importation of Prescription Drugs Final 

Rule Questions and Answers.’’ The 

guidance is intended to help small 

entities comply with the final rule 

entitled ‘‘Importation of Prescription 

Drugs.’’ The final rule was issued to 

implement a provision of the Federal 

Food, Drug, and Cosmetic Act (FD&C 

Act) to allow importation of certain 

prescription drugs from Canada. 

DATES: The announcement of the 

guidance is published in the Federal 

Register on May 26, 2022. 

ADDRESSES: You may submit either 

electronic or written comments on 

Agency guidances at any time as 

follows: 

Electronic Submissions 

Submit electronic comments in the 

following way: 

• Federal eRulemaking Portal: 

https://www.regulations.gov. Follow the 

instructions for submitting comments. 

Comments submitted electronically, 

including attachments, to https://

www.regulations.gov will be posted to 

the docket unchanged. Because your 

comment will be made public, you are 

solely responsible for ensuring that your 

comment does not include any 

confidential information that you or a 

third party may not wish to be posted, 

such as medical information, your or 

anyone else’s Social Security number, or 

confidential business information, such 

as a manufacturing process. Please note 

that if you include your name, contact 

information, or other information that 

identifies you in the body of your 

comments, that information will be 

posted on https://www.regulations.gov. 

• If you want to submit a comment 

with confidential information that you 

do not wish to be made available to the 

public, submit the comment as a 

written/paper submission and in the 

manner detailed (see ‘‘Written/Paper 

Submissions’’’’ and ‘‘Instructions’’). 

Written/Paper Submissions 

Submit written/paper submissions as 

follows: 

• Mail/Hand Delivery/Courier (for 

written/paper submissions): Dockets 

Management Staff (HFA–305), Food and 

Drug Administration, 5630 Fishers 

Lane, Rm. 1061, Rockville, MD 20852. 

• For written/paper comments 

submitted to the Dockets Management 

Staff, FDA will post your comment, as 

well as any attachments, except for 

information submitted, marked and 

identified, as confidential, if submitted 

as detailed in ‘‘Instructions.’’ 

Instructions: All submissions received 

must include the Docket No. FDA– 

2021–D–0958 for ‘‘Importation of 

Prescription Drugs Final Rule Questions 

and Answers.’’ Received comments will 

be placed in the docket and, except for 

those submitted as ‘‘Confidential 

Submissions,’’ publicly viewable at 

https://www.regulations.gov or at the 

Dockets Management Staff between 9 

a.m. and 4 p.m., Monday through 

Friday, 240–402–7500. 

• Confidential Submissions—To 

submit a comment with confidential 


khammond on DSKJM1Z7X2PROD with RULES