Changes To BIS's Information Security Controls Bring Relaxed Controls, Removal Of Registration Requirement

As part of a raft of revisions to the Export Administration Regulations ("EAR") implementing December 2015 changes to the Wassenaar Arrangement, on September 20, 2016, the Bureau of Industry and Security ("BIS") issued a final rule affecting the Commerce Control List ("CCL") and parts of the EAR relating to Information Security.¹ While the changes represent perhaps the most substantial update to the EAR's encryption and information security controls since those rules were simplified in 2010, they do not fundamentally alter the existing framework of those controls. Rather, they reduce certain compliance burdens and relax controls for a number of items, while increasing controls on a limited subset of encryption items. Businesses potentially affected by these changes should review the rule carefully in order to be able to benefit from these changes while remaining compliant with the rule.